What Happened
SAP released its July 2026 Security Patch Day on July 14, publishing 16 new security notes and updating three previously released notes. The most severe is CVE-2026-44747, a CVSS 9.9 memory corruption vulnerability in SAP NetWeaver Application Server ABAP. The flaw arises from logical errors in memory management that an authenticated attacker with low privileges can trigger remotely over the network without any user interaction. Successful exploitation gives the attacker the ability to read, modify, or destroy data and to make affected systems unavailable — a combination of full CIA triad impact at near-maximum severity.
Affected versions cover a wide range of SAP kernel and NetWeaver releases: KRNL64NUC and KRNL64UC 7.22 and 7.22EXT, and SAP kernel versions 7.53, 7.54, 7.77, 7.89, 7.93, 9.16, 9.18, 9.19, and 9.20. The fix is available via SAP Security Note 3747367. SAP also patched critical vulnerabilities in SAP Approuter and SAP Commerce Cloud in the same release.
Why This Matters for Canadian Organizations
SAP NetWeaver ABAP is the runtime environment underpinning SAP ERP, S/4HANA, and a wide range of enterprise applications used by Canadian organizations in manufacturing, financial services, government, retail, and healthcare. A CVSS 9.9 rating on a network-exploitable, low-privilege, no-interaction flaw in this layer is as serious as enterprise software vulnerabilities get.
The combination of attack characteristics matters: an attacker with any valid low-privilege SAP account — or one obtained through credential theft, phishing, or a prior breach — can exploit this flaw from the network without needing to trick anyone into clicking a link or opening a file. In large SAP environments with many users and service accounts, that authentication bar is low.
For Canadian financial institutions operating under OSFI’s B-13 Technology and Cyber Risk Management guideline, SAP systems often process sensitive financial data, payroll, and customer account information. A memory corruption exploit of this class creates direct breach notification exposure under PIPEDA if personal information is accessed or modified. For organizations in the federal public sector, SAP instances handling Treasury Board-governed data require equivalent urgency. Canadian manufacturers with SAP in production environments also face operational disruption risk if a system availability attack succeeds.
What to Do
Apply SAP Security Note 3747367 to all affected NetWeaver ABAP kernel versions as a priority patch this week. If your SAP environment is managed by a third-party vendor or system integrator, confirm they have a patch timeline and escalate if patching is not scheduled within days rather than weeks. Review SAP user accounts for dormant, shared, or overly permissive accounts that an attacker with low privileges could leverage — this flaw’s low authentication bar makes user hygiene a secondary control worth tightening now. Also apply patches for the critical Approuter and Commerce Cloud flaws covered in the same release. Log the patch action in your vulnerability management records as required under OSFI B-13 and maintain evidence for any regulator audit trail.
Source: SecurityWeek
