{"id":14570,"date":"2026-07-20T10:28:04","date_gmt":"2026-07-20T08:28:04","guid":{"rendered":"https:\/\/www.inprosec.com\/?p=14570"},"modified":"2026-07-20T10:28:04","modified_gmt":"2026-07-20T08:28:04","slug":"sap-security-notes-july-2026","status":"publish","type":"post","link":"https:\/\/www.inprosec.com\/en\/sap-security-notes-july-2026\/","title":{"rendered":"SAP Security Notes, July 2026"},"content":{"rendered":"

Through services such as the SAP Security Assessment, Inprosec helps its clients improve the security levels of their SAP systems.<\/b><\/p>\n\n

July 2026 Notes<\/h2>\n

Monthly Summary and Highlights<\/h3>\n
\n
\n
\n
\n
\n
\n
\n
This month, the total number was 20 notes<\/b> (16 new, 1 security advisory and 3 updates), 5 more than in June. This month, 4 Hot News were published, the same number as in the previous period. As for high criticality notes, there are 6, four more compared to June. Medium and low notes will not be reviewed, so we will detail a total of 10 notes<\/b> (all with a CVSS of 7 or higher).<\/div>\n
We have a total of 20 notes<\/b> for the month (16 new, 1 security advisory and 3 updates to notes from previous months).<\/div>\n
We will review in detail a total of 10 notes, all of high criticality and Hot News:<\/div>\n
<\/div>\n
    \n
  1. \n
    The highest criticality note of the month (CVSS <\/b>9.9<\/b><\/span>) is a Hot News and is related to “Memory Corruption vulnerability in SAP NetWeaver Application Server ABAP”<\/b>.<\/div>\n<\/li>\n
  2. \n
    The second highest criticality note (CVSS <\/b>9.1<\/b><\/span>) is another Hot News and is related to “HTTP Request Smuggling in SAP Approuter”<\/b>.<\/div>\n<\/li>\n
  3. \n
    The third note with the same criticality (CVSS <\/b>9.1<\/b><\/span>) is another Hot News and is related to “Insecure Sample Credentials in SAP Commerce Cloud”<\/b>.<\/div>\n<\/li>\n
  4. \n
    The fourth highest criticality note (CVSS <\/b>9.0<\/b><\/span>) is the last Hot News of the month and is related to “Directory Traversal vulnerability in SAP NetWeaver Application Server Java (Web Container)”<\/b>.<\/div>\n<\/li>\n
  5. \n
    The fifth note we will review (CVSS <\/b>8.8<\/b><\/span>) is of high criticality and deals with “Multiple vulnerabilities in Apache Camel within SAP Integration Suite (Edge Integration Cell)”<\/b>.<\/div>\n<\/li>\n
  6. \n
    The sixth note we will review (CVSS <\/b>8.4<\/b><\/span>) is of high criticality and deals with “DLL Hijacking vulnerability in SAProuter on Microsoft Windows”<\/b>.<\/div>\n<\/li>\n
  7. \n
    The seventh note we will review (CVSS <\/b>8.2<\/b><\/span>) is of high criticality and deals with “Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java(Configuration Wizard)”<\/b>.<\/div>\n<\/li>\n
  8. \n
    The eighth note we will review (CVSS <\/b>8.1<\/b><\/span>) is of high criticality and deals with “Open Redirect vulnerability in SAP Approuter”<\/b>.<\/div>\n<\/li>\n
  9. \n
    The ninth note with the same criticality (CVSS <\/b>8.1<\/b><\/span>) is of high criticality and deals with “Multiple vulnerabilities in Apache Tomcat within SAP Commerce Cloud”<\/b>.<\/div>\n<\/li>\n
  10. \n
    The tenth and last note we will review (CVSS <\/b>7.6<\/b><\/span>) is of high criticality and deals with “Remote Code Execution vulnerability in SAP Change and Transport System Attach Tool (ctsattach)”<\/b>.<\/div>\n
    <\/div>\n<\/li>\n<\/ol>\n
    This month, the most predominant type has been “Cross-Site Scripting (XSS)”<\/b> (3\/20 in the patch day).<\/div>\n
    In the chart, we can see the classification of July’s notes, as well as the evolution and classification of the previous 5 months (only Sec. Tuesday \/ Patch Day notes \u2013 by SAP):<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n
    <\/div>\n<\/div>\n<\/div>\n

    \"\"<\/p>\n

    Full details<\/h2>\n

    The full details of the most relevant notes<\/b> are as follows (in English):<\/p>\n

      \n
    1. \n
      Memory Corruption vulnerability in SAP NetWeaver Application Server ABAP (<\/b>3747367<\/b><\/a>)<\/b>: SAP NetWeaver Application Server ABAP allows an authenticated attacker to leverage logical errors in memory management to cause a memory corruption that could lead to unauthorised data access, modification, or system unavailability. This has high impact on confidentiality, integrity, and availability of the application. A temporary workaround is available. CVSS v3 Base Score <\/b>9.9<\/b><\/span>\/10 [<\/b>CVE-2026-44747<\/b><\/a>]<\/b><\/div>\n<\/li>\n
    2. \n
      HTTP Request Smuggling in SAP Approuter (<\/b>3720138<\/b><\/a>)<\/b>: Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronisation. This could result in the exposure of user responses and cause the system to become unavailable. This leads to a high impact on confidentiality and availability. CVSS v3 Base Score <\/b>9.1<\/b><\/span>\/10 [<\/b>CVE-2026-27690<\/b><\/a>]<\/b><\/div>\n<\/li>\n
    3. \n
      Insecure Sample Credentials in SAP Commerce Cloud (<\/b>3753495<\/b><\/a>)<\/b>: SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known credentials to obtain a valid access token and invoke certain APIs to read and modify data. Successful exploitation results in high impact on confidentiality and integrity, with no impact on availability. A temporary workaround is available. CVSS v3 Base Score <\/b>9.1<\/b><\/span>\/10 [<\/b>CVE-2026-44761<\/b><\/a>]<\/b><\/div>\n<\/li>\n
    4. \n
      Directory Traversal vulnerability in SAP NetWeaver Application Server Java (Web Container) (<\/b>3727078<\/b><\/a>)<\/b>: SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft a malicious HTTP logon request that manipulates file inclusion parameters, enabling path traversal and processing of the included file. Processing the included file could allow the attacker to view or modify sensitive information or render any part of the local system unavailable. CVSS v3 Base Score <\/b>9.0<\/b><\/span>\/10 [<\/b>CVE-2026-40128<\/b><\/a>]<\/b><\/div>\n<\/li>\n
    5. \n
      Multiple vulnerabilities in Apache Camel within SAP Integration Suite (Edge Integration Cell) (<\/b>3758101<\/b><\/a>)<\/b>: This Security note addresses multiple known vulnerabilities in Apache Camel within SAP Integration Suite. These issues impact message-based header injection and deserialisation mechanisms in camel mail and JMS components, allowing attackers to achieve remote code execution and arbitrary file writes on downstream components. It has a high impact on confidentiality, integrity and availability of the application. A temporary workaround is available. CVSS v3 Base Score <\/b>8.8<\/b><\/span>\/10 [<\/b>CVE-2026-40860<\/b><\/a>, <\/b>CVE-2026-40453<\/b><\/a>, <\/b>CVE-2026-33454<\/b><\/a>]<\/b><\/div>\n<\/li>\n
    6. \n
      DLL Hijacking vulnerability in SAProuter on Microsoft Windows (<\/b>3692165<\/b><\/a>)<\/b>: SAProuter on Microsoft Windows allows an unauthenticated attacker to load library (DLL) files from an untrusted location, allowing them to execute malicious code on the system. This could enable the attacker to hijack the DLL loading process and achieve arbitrary code execution. This has high impact on confidentiality, integrity and availability of the system. CVSS v3 Base Score <\/b>8.4<\/b><\/span>\/10 [<\/b>CVE-2026-0487<\/b><\/a>]<\/b><\/div>\n<\/li>\n
    7. \n
      Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java(Configuration Wizard) (<\/b>3748227<\/b><\/a>)<\/b>: SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafted URLs. When a victim accesses such a URL, the script executes in the user’s browser, allowing the attacker to access sensitive session information and modify non-sensitive data displayed in the client’s browser. This results in a high impact on confidentiality, low impact on integrity with no impact on availability of the application. A temporary workaround is available. CVSS v3 Base Score <\/b>8.2<\/b><\/span>\/10 [<\/b>CVE-2026-44752<\/b><\/a>]<\/b><\/div>\n<\/li>\n
    8. \n
      Open Redirect vulnerability in SAP Approuter (<\/b>3741519<\/b><\/a>)<\/b>: SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations. This allows an unauthenticated remote attacker to craft a malicious link which, when clicked by a victim, could lead to unauthorised access. Successful exploitation results in a high impact to the confidentiality and integrity with no impact on the availability of the application. A temporary workaround is available. CVSS v3 Base Score <\/b>8.1<\/b><\/span>\/10 [<\/b>CVE-2026-44745<\/b><\/a>]<\/b><\/div>\n<\/li>\n
    9. \n
      Multiple vulnerabilities in Apache Tomcat within SAP Commerce Cloud (<\/b>3763800<\/b><\/a>)<\/b>: This Security Note addresses multiple known vulnerabilities in Apache Tomcat used by SAP Commerce Cloud. Remote unauthenticated attackers could exploit these vulnerabilities to bypass authentication, send crafted HTTP\/2 requests, or bypass authorisation rules, potentially resulting in a high impact on the confidentiality, integrity, and availability of the application. A temporary workaround is available. CVSS v3 Base Score <\/b>8.1<\/b><\/span>\/10 [<\/b>CVE-2026-43512<\/b><\/a>, <\/b>CVE-2026-41293<\/b><\/a>, <\/b>CVE-2026-43515<\/b><\/a>]<\/b><\/div>\n<\/li>\n
    10. \n
      Multiple vulnerabilities in Apache Tomcat within SAP Commerce Cloud (<\/b>3763800<\/b><\/a>): <\/b>This Security Note addresses multiple known vulnerabilities in Apache Tomcat used by SAP Commerce Cloud. Remote unauthenticated attackers could exploit these vulnerabilities to bypass authentication, send crafted HTTP\/2 requests, or bypass authorisation rules, potentially resulting in a high impact on the confidentiality, integrity, and availability of the application. A temporary workaround is available. CVSS v3 Base Score 8.1<\/span>\/10<\/strong> [<\/b>CVE-2026-43512<\/b><\/a>, <\/b>CVE-2026-41293<\/b><\/a>, <\/b>CVE-2026-43515<\/b><\/a>]<\/b><\/div>\n<\/li>\n
    11. \n
      Remote Code Execution vulnerability in SAP Change and Transport System Attach Tool (ctsattach) (<\/b>3773304<\/b><\/a>)<\/b>: SAP Change and Transport System Attach Tool (ctsattach) allows an authenticated attacker to supply a specially crafted archive file which, when processed by the application’s library, can trigger insecure deserialisation and lead to remote code execution (RCE) on the system. Successful exploitation requires a victim to process the malicious archive, enabling the attacker to execute the RCE and extract sensitive information and gain control over the system and its processes. This vulnerability has a high impact on confidentiality and integrity of the data, with a low impact on the availability of the system. CVSS v3 Base Score <\/b>7.6<\/b><\/span>\/10 [<\/b>CVE-2026-58233<\/b><\/a>]<\/b><\/div>\n<\/li>\n<\/ol>\n

       <\/p>\n

      Reference links<\/strong><\/p>\n

      References, in English, from SAP and Onapsis:<\/div>\n