SAP Security Patch Day: July 2026
Released July 14, 2026 · 16 notes · Source: CVE records on CVE.org (SAP as CNA)
Scheduled for July 14, 2026 (second Tuesday)
- SAP notes
- 15
- GitHub advisories
- 1
- Critical
- 3
- High
- 4
- Highest CVSS
- 9.9
- Known exploited
- 0
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Our summary
16 notes with SAP CVEs. 3 Critical and 4 High (priority derived from CVSS, not SAP’s priority). Highest CVSS 9.9.
What to patch first
Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.
Memory Corruption vulnerability in SAP NetWeaver Application Server ABAP
HTTP Request Smuggling in SAP Approuter
Insecure Sample Credentials in SAP Commerce Cloud
DLL Hijacking vulnerability in SAProuter on Microsoft Windows
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java(Configuration Wizard)
Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)
All notes
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Coverage: this site is built from SAP’s CVE records, so notes without a CVE, notes with only third-party CVEs (for example Apache or OpenSSL), and updates to earlier notes are not covered. That is about 7% of new notes.
Showing 16 of 16
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3747367 | Memory Corruption vulnerability in SAP NetWeaver Application Server ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | Critical | 9.9 | CVE-2026-44747 |
| 3720138 | HTTP Request Smuggling in SAP Approuter New | SAP Approuter | Critical | 9.1 | CVE-2026-27690 |
| 3753495 | Insecure Sample Credentials in SAP Commerce Cloud New | SAP Commerce Cloud | Critical | 9.1 | CVE-2026-44761 |
| 3692165 | DLL Hijacking vulnerability in SAProuter on Microsoft Windows New | SAProuter on Microsoft Windows | High | 8.4 | CVE-2026-0487 |
| 3748227 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java(Configuration Wizard) New | SAP NetWeaver AS Java | High | 8.2 | CVE-2026-44752 |
| 3741519 | Open Redirect vulnerability in SAP Approuter New | SAP Approuter | High | 8.1 | CVE-2026-44745 |
| 3773304 | Remote Code Execution vulnerability in SAP Change and Transport System Attach Tool (ctsattach) New | SAP Change and Transport System Attach Tool | High | 7.6 | CVE-2026-58233 |
| 3746678 | Cross Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal New | SAP NetWeaver Enterprise Portal | Medium | 6.1 | CVE-2026-44759 |
| GHSA-p8gx-753q-v89p | Allowlist Bypass in setThemeRoot() Enables Cross-Origin CSS Injection New | @ui5/webcomponents-base | Medium | 6.1 | CVE-2026-44767 |
| 3537373 | SQL Injection vulnerability in SAP S/4HANA Project Management (PPM-PRO) New | SAP S/4HANA Project Management | Medium | 5.5 | CVE-2026-44769 |
| 3754659 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on Business Server Pages) New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.7 | CVE-2026-44760 |
| 3413033 | Information Disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform NewPublished outside Patch Day | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.3 | CVE-2026-58246 |
| 3515598 | Missing Authorization check in SAP S/4HANA (Draft operation) New | SAP S/4HANA | Medium | 4.3 | CVE-2026-44771 |
| 3713902 | Missing Authorization check in SAP S/4 HANA (Create Single Payment) New | SAP S/4HANA | Medium | 4.3 | CVE-2026-44770 |
| 3155685 | Security misconfiguration in SAP CRM (WebClient UI) New | SAP CRM | Medium | 4.1 | CVE-2026-44768 |
| 3732522 | Information Disclosure vulnerability in SAP HANA Extended Application Services classic model (User Self Service) New | SAP HANA Extended Application Services classic model | Low | 3.7 | CVE-2026-44753 |