{"id":13479,"date":"2026-06-09T10:03:40","date_gmt":"2026-06-09T10:03:40","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/06\/09\/sap-security-patch-day-critical-vulnerabilities-in-sap-netweaver-patched\/"},"modified":"2026-06-09T10:03:40","modified_gmt":"2026-06-09T10:03:40","slug":"sap-security-patch-day-critical-vulnerabilities-in-sap-netweaver-patched","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/06\/09\/sap-security-patch-day-critical-vulnerabilities-in-sap-netweaver-patched\/","title":{"rendered":"SAP Security Patch Day \u2013 Critical Vulnerabilities in SAP NetWeaver Patched"},"content":{"rendered":"

SAP Security Patch Day \u2013 Critical Vulnerabilities in SAP NetWeaver Patched
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

SAP\u2019s June 2026 Security Patch Day, observed on Tuesday, June 9, delivered 15 new security notes addressing a broad range of vulnerabilities across core SAP products, including four critical-severity flaws that demand immediate enterprise attention.<\/p>\n

SAP strongly urges all customers to visit the SAP Support Portal and apply the patches on priority to protect their SAP landscape.<\/p>\n

Critical Vulnerabilities Patched<\/strong><\/h2>\n

The most severe flaw patched this cycle is CVE-2026-44748 (CVSS 9.9), an XML Signature Wrapping vulnerability in SAML Authentication<\/a> affecting SAP NetWeaver AS ABAP and ABAP Platform.<\/p>\n

This flaw allows an authenticated attacker with low privileges to obtain a valid signed message and transmit modified XML documents to the verifier, potentially enabling acceptance of tampered identity information, unauthorized access to sensitive user data, and privilege escalation across enterprise systems. The vulnerability spans an extensive range of SAP_BASIS versions from 702 through 919, making the patch footprint exceptionally wide.<\/p>\n

A second critical issue, CVE-2026-27671 (CVSS 9.8), targets the Application Server ABAP kernel and introduces a memory corruption risk via improper RFC protocol validation.<\/p>\n

Unlike the SAML flaw, this vulnerability is unauthenticated; an attacker can send a specially crafted RFC request that exploits logical errors in memory management without any valid credentials, leading to high-impact compromise of confidentiality, integrity, and availability. Affected components include multiple KRNL64NUC, KRNL64UC, and KERNEL versions.<\/p>\n

CVE-2026-22732 (CVSS 9.1) patches a Spring Security vulnerability<\/a> within SAP Commerce Cloud and SAP Data Hub, enabling unauthenticated remote attackers to impact confidentiality and integrity without user interaction.<\/p>\n

Completing the critical quartet is CVE-2026-40128 (CVSS 9.0), a Directory Traversal flaw in the SAP NetWeaver Application Server Java Web Container (ENGINEAPI 7.50), where a network-accessible attacker can traverse directory structures to reach sensitive resources under high confidentiality, integrity, and availability impact.<\/p>\n

High-Severity Patches<\/strong><\/h2>\n

SAP also addressed two high-priority notes this cycle. CVE-2026-29145 (CVSS 7.4) bundles multiple Apache Tomcat vulnerabilities \u2014 including CVE-2025-66614 and CVE-2026-24734 within SAP Commerce Cloud (HY_COM 2205, COM_CLOUD 2211), allowing unauthenticated attackers to exploit weaknesses in the embedded Tomcat server.<\/p>\n

CVE-2026-44751 (CVSS 7.1) fixes a Missing Authorization Check in SAP NetWeaver AS ABAP and ABAP Platform affecting SAP_BASIS versions 700 through 816, where a low-privileged network attacker could achieve high integrity impact and partial availability disruption.<\/p>\n

Medium and Low Severity Notes<\/strong><\/h2>\n
\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Note #<\/th>\nCVE<\/th>\nProduct<\/th>\nVulnerability Type<\/th>\nCVSS<\/th>\n<\/tr>\n<\/thead>\n
3748819<\/td>\nCVE-2026-44754<\/td>\nODP Data Replication APIs<\/td>\nMissing Caller Identification<\/td>\n6.6<\/td>\n<\/tr>\n
3751691<\/td>\nCVE-2026-44744<\/td>\nSAP S\/4HANA<\/td>\nSQL Injection<\/td>\n6.5<\/td>\n<\/tr>\n
3723655<\/td>\nCVE-2026-44746<\/td>\nSAP NetWeaver AS Java (JDBC Test Servlet)<\/td>\nReflected XSS<\/td>\n6.1<\/td>\n<\/tr>\n
3715280<\/td>\nCVE-2026-44757<\/td>\nSAP Wily Introscope Enterprise Manager<\/td>\nCross-Site Scripting<\/td>\n4.7<\/td>\n<\/tr>\n
3673181<\/td>\nCVE-2026-44750<\/td>\nSAP MDG (Review Match Groups)<\/td>\nMissing Authorization<\/td>\n4.3<\/td>\n<\/tr>\n
3687096<\/td>\nCVE-2026-44755<\/td>\nSAP BusinessObjects BI Platform<\/td>\nEmail Spoofing<\/td>\n4.3<\/td>\n<\/tr>\n
3682699<\/td>\nCVE-2026-24315<\/td>\nSAP Fiori (Launchpad)<\/td>\nPath Traversal<\/td>\n4.2<\/td>\n<\/tr>\n
3706000<\/td>\nCVE-2026-44743<\/td>\nSAP Business Objects<\/td>\nSecurity Misconfiguration<\/td>\n3.7<\/td>\n<\/tr>\n
3726899<\/td>\nCVE-2025-68161<\/td>\nSAP NetWeaver AS Java<\/td>\nApache Log4j Exposure<\/td>\n3.3<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

The SQL Injection flaw in SAP S\/4HANA (CVE-2026-44744, CVSS 6.5) poses a notable data exposure risk, allowing authenticated low-privileged attackers to query sensitive database content via crafted inputs across S4FND versions 102 through 109.<\/p>\n

The Reflected XSS in SAP NetWeaver\u2019s JDBC Test Servlet (CVE-2026-44746) and the Log4j-related advisory in SAP NetWeaver AS Java (CVE-2025-68161) round out the lower-tier patches, though the latter serves as a reminder that third-party library dependencies within SAP products continue to introduce residual risk.<\/p>\n

Security teams managing SAP environments should prioritize remediation in the following order:<\/p>\n

    \n
  1. \nCVE-2026-44748<\/strong> \u2013 Apply the SAML XML Signature fix immediately across all SAP_BASIS versions; as a temporary workaround, SAML authentication can be disabled, though this does not cover all signed XML use cases.<\/li>\n
  2. \nCVE-2026-27671<\/strong> \u2013 Patch all affected SAP Kernel versions (7.22\u20139.19) to eliminate the unauthenticated RFC memory corruption vector.<\/li>\n
  3. \nCVE-2026-22732 & CVE-2026-40128<\/strong> \u2013 Update SAP Commerce Cloud, SAP Data Hub, and NetWeaver Java (ENGINEAPI 7.50) to remediate the Spring Security and Directory Traversal flaws<\/li>\n
  4. \nCVE-2026-29145<\/strong> \u2013 Apply the Apache Tomcat bundle patch for SAP Commerce Cloud to address multiple embedded server vulnerabilities<\/li>\n
  5. \nRemaining medium\/low notes<\/strong> \u2013 Schedule within the standard monthly patch management cycle, particularly prioritizing the S\/4HANA SQL injection and NetWeaver AS Java XSS fixes<\/li>\n<\/ol>\n

    SAP Security Patch Day is scheduled for the second Tuesday of every month. Organizations are strongly advised to implement a structured SAP patch management process and monitor the SAP Security Notes portal<\/a> for any out-of-band updates following this cycle.<\/p>\n

    Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates.<\/strong><\/p>\n

    The post SAP Security Patch Day \u2013 Critical Vulnerabilities in SAP NetWeaver Patched<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

    \t

    \n
    <\/BR>
    \n Guru Baran
    \n \t

    \n
    <\/BR>
    \n    Go to cyber-security-news<\/a>
    \n \t

    \n
    <\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

    SAP Security Patch Day \u2013 Critical Vulnerabilities in SAP NetWeaver Patched SAP\u2019s June 2026 Security Patch Day, observed on Tuesday, June 9, delivered 15 new security notes addressing a broad range of vulnerabilities across core SAP products, including four critical-severity flaws that demand immediate enterprise attention. SAP strongly urges all customers to visit the SAP […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,131,648],"tags":[130],"class_list":["post-13479","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-vulnerability","category-vulnerability-news","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/13479"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=13479"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/13479\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=13479"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=13479"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=13479"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}