SAP’s patch for the critical NetWeaver AS ABAP vulnerability highlights why enterprise ERP platforms must be treated as crown-jewel systems, not just back-office software.

The flaw, tracked as CVE-2026-44748 with a CVSS score of 9.9, affects SAML authentication in SAP NetWeaver AS ABAP and ABAP Platform. It involves XML signature wrapping, where an authenticated attacker with normal privileges could tamper with signed SAML messages and alter identity information.

This is serious because SAP systems often manage finance, procurement, HR, inventory, manufacturing, customer records, and business workflows. If an attacker can manipulate authentication or escalate access inside SAP, the impact can go far beyond one application account.

Organizations should apply the SAP security notes immediately, especially on internet-facing or business-critical SAP systems. Security teams should also review SAML configurations, identity-provider trust settings, privileged accounts, unusual login activity, and changes to roles or authorizations.

Patching should be followed by investigation. Since authentication flaws can allow attackers to appear as legitimate users, logs should be reviewed for abnormal access patterns, suspicious RFC activity, unexpected administrative actions, and unusual data exports.

The key lesson is that ERP security is business security. A critical authentication flaw in SAP is not just an IT issue; it can become a finance, operations, compliance, and fraud issue very quickly. Apparently, even the system that approves invoices now needs to prove it knows who is actually clicking the button.

SAP has rolled out updates to address multiple vulnerabilities as part of its July 2026 security updates, including a critical flaw in SAP NetWeaver Application Server ABAP. The vulnerability in question is CVE-2026-44747 (CVSS score: 9.9), an out-of-bounds write flaw that allows an authenticated attacker to leverage logical errors in memory management to cause a memory corruption that could

Source: SAP Patches CVSS 9.9 NetWeaver ABAP Flaw That Could Expose or Modify Data via The Hacker News — published 14 Jul 2026.