[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f5RG_YwvAgXd6kj1mvOHik_I_xQJuuH8itqLp3prN84E":3},{"article":4,"iocs":45,"watch_terms":59,"solutions":60,"lesson":146},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"4cb9585c-da94-4d64-8f2e-81a479b6660f","SAP Patches Critical NetWeaver, Commerce Vulnerabilities","sap-patches-critical-netweaver-commerce-vulnerabilities-7264fd","The flaws could lead to the disclosure of sensitive information, memory corruption, and disruption of normal system usage. The post SAP Patches Critical NetWeaver, Commerce Vulnerabilities appeared first on SecurityWeek.","SAP has released 15 new security notes, addressing four critical vulnerabilities in its NetWeaver, Commerce, and Data Hub products. The most severe flaw, CVE-2026-44748, is an XML Signature Wrapping issue in NetWeaver's SAML authentication, allowing authenticated attackers to tamper with identity information and access sensitive data. Other critical vulnerabilities include memory corruption in NetWeaver, an issue in Commerce Cloud and Data Hub related to the Spring Security framework, and a directory traversal vulnerability in NetWeaver Application Server Java.","SAP patches 15 security notes, including four critical vulnerabilities in NetWeaver, Commerce, and Data Hub.","https:\u002F\u002Fwww.securityweek.com\u002Fsap-patches-critical-netweaver-commerce-vulnerabilities\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F02\u002FSAP.jpeg","2026-06-09T12:15:30+00:00","2026-06-09T14:00:06.66312+00:00",8,[17,20,23,25,27,30],{"name":18,"type":19},"SAP","vendor",{"name":21,"type":22},"NetWeaver","product",{"name":24,"type":22},"Commerce",{"name":26,"type":22},"Data Hub",{"name":28,"type":29},"SAML","technology",{"name":31,"type":29},"Spring Security","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,40],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[46,50,53,56],{"type":47,"value":48,"context":49},"cve","CVE-2026-44748","Critical XML Signature Wrapping vulnerability in SAP NetWeaver SAML Authentication.",{"type":47,"value":51,"context":52},"CVE-2026-27671","Critical memory corruption issue in SAP NetWeaver and ABAP Platform.",{"type":47,"value":54,"context":55},"CVE-2026-22732","Critical vulnerability impacting SAP Commerce Cloud and Data Hub due to Spring Security framework.",{"type":47,"value":57,"context":58},"CVE-2026-40128","Critical directory traversal vulnerability in SAP NetWeaver Application Server Java.",[18,21,26],{"controls":61,"vendors":145},[62,91,120],{"slug":63,"name":64,"problem":65,"products":66},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":92,"name":93,"problem":94,"products":95},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":121,"name":122,"problem":123,"products":124},"patch-management","Automated patch management","Known holes get closed in days, not months.",[125,133,141],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":121,"product_name":142,"url":143,"description":144},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",[],{"slug":147,"title":148,"body":149,"framework_refs":150,"framework_notes":156},"critical-sap-vulnerabilities-expose-enterprise-systems-to-authentication-bypass-and-data-access","Critical SAP Vulnerabilities Expose Enterprise Systems to Authentication Bypass and Data Access","SAP released patches for 15 security vulnerabilities, including four critical flaws affecting widely-used enterprise systems like NetWeaver and Commerce Cloud. The most severe vulnerability (CVE-2026-44748) allows authenticated attackers to manipulate SAML authentication through XML Signature Wrapping, potentially gaining unauthorized access to sensitive business data. These vulnerabilities demonstrate how authentication bypass flaws in enterprise software can create significant security gaps, especially given SAP's central role in managing critical business processes and financial data across organizations.",[151,152,153,154,155],"CIS Control 7.1","NIST CM-3","NIST SI-2","ISO 27001 A.12.6.1","OWASP SAMM VM1",{}]