SAP Patches Critical NetWeaver, Commerce Vulnerabilities
SAP patches 15 security notes, including four critical vulnerabilities in NetWeaver, Commerce, and Data Hub.
SAP has released 15 new security notes, addressing four critical vulnerabilities in its NetWeaver, Commerce, and Data Hub products. The most severe flaw, CVE-2026-44748, is an XML Signature Wrapping issue in NetWeaver's SAML authentication, allowing authenticated attackers to tamper with identity information and access sensitive data. Other critical vulnerabilities include memory corruption in NetWeaver, an issue in Commerce Cloud and Data Hub related to the Spring Security framework, and a directory traversal vulnerability in NetWeaver Application Server Java.
AI summary of the linked source. Not reviewed by an editor. How this works
Run SAP?
Get an email when a new story names SAP, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonSAP released patches for 15 security vulnerabilities, including four critical flaws affecting widely-used enterprise systems like NetWeaver and Commerce Cloud. The most severe vulnerability (CVE-2026-44748) allows authenticated attackers to manipulate SAML authentication through XML Signature Wrapping, potentially gaining unauthorized access to sensitive business data. These vulnerabilities demonstrate how authentication bypass flaws in enterprise software can create significant security gaps, especially given SAP's central role in managing critical business processes and financial data across organizations.
What helps against this
How we list vendors- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-44748
- cve — CVE-2026-27671
- cve — CVE-2026-22732
- cve — CVE-2026-40128