Patch Day: July 2026
Released July 14, 2026 · 22 notes · Source: SAP Security Patch Day page
Scheduled for July 14, 2026 (second Tuesday)
- New
- 18
- Updated
- 4
- Critical
- 4
- High
- 7
- Highest CVSS
- 9.9
- Known exploited
- 0
Our summary
22 notes (18 new, 4 updated). 4 Critical and 7 High. Highest CVSS 9.9.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Memory Corruption vulnerability in SAP NetWeaver Application Server ABAP
HTTP Request Smuggling in SAP Approuter
Insecure Sample Credentials in SAP Commerce Cloud
Directory Traversal vulnerability in SAP NetWeaver Application Server Java (Web Container)
Multiple vulnerabilities in Apache Camel within SAP Integration Suite (Edge Integration Cell)
All notes
SAP’s introduction states 16 new notes and 3 updates; SAP’s table lists 22 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 22 of 22
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3747367 | Memory Corruption vulnerability in SAP NetWeaver Application Server ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | Critical | 9.9 | CVE-2026-44747 |
| 3720138 | HTTP Request Smuggling in SAP Approuter New | SAP Approuter | Critical | 9.1 | CVE-2026-27690 |
| 3753495 | Insecure Sample Credentials in SAP Commerce Cloud New | SAP Commerce Cloud | Critical | 9.1 | CVE-2026-44761 |
| 3727078 | Directory Traversal vulnerability in SAP NetWeaver Application Server Java (Web Container) Update | SAP NetWeaver AS Java | Critical | 9.0 | CVE-2026-40128 |
| 3758101 | Multiple vulnerabilities in Apache Camel within SAP Integration Suite (Edge Integration Cell) New | SAP Integration Suite | High | 8.8 | CVE-2026-40860, CVE-2026-40453, CVE-2026-33454 |
| 3692165 | DLL Hijacking vulnerability in SAProuter on Microsoft Windows New | SAProuter on Microsoft Windows | High | 8.4 | CVE-2026-0487 |
| 3732471 | OS Command Injection Vulnerability in SAP Forecasting & Replenishment Update | SAP Forecasting & Replenishment | High | 8.2 | CVE-2026-34259 |
| 3748227 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java(Configuration Wizard) New | SAP NetWeaver AS Java | High | 8.2 | CVE-2026-44752 |
| 3741519 | Open Redirect vulnerability in SAP Approuter New | SAP Approuter | High | 8.1 | CVE-2026-44745 |
| 3763800 | Multiple vulnerabilities in Apache Tomcat within SAP Commerce Cloud New | SAP Commerce Cloud | High | 8.1 | CVE-2026-43512, CVE-2026-41293, CVE-2026-43515 |
| 3773304 | Remote Code Execution vulnerability in SAP Change and Transport System Attach Tool (ctsattach) New | SAP Change and Transport System Attach Tool | High | 7.6 | CVE-2026-58233 |
| 3746678 | Cross Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal New | SAP NetWeaver Enterprise Portal | Medium | 6.1 | CVE-2026-44759 |
| GHSA-p8gx-753q-v89p | Allowlist Bypass in setThemeRoot() Enables Cross-Origin CSS Injection New | ui5/webcomponents-base | Medium | 6.1 | CVE-2026-44767 |
| 3537373 | SQL Injection vulnerability in SAP S/4HANA Project Management (PPM-PRO) New | SAP S/4HANA Project Management | Medium | 5.5 | CVE-2026-44769 |
| 3754659 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on Business Server Pages) New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.7 | CVE-2026-44760 |
| 3413033 | Information Disclosure vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.3 | CVE-2026-58246 |
| 3515598 | Missing Authorization check in SAP S/4HANA (Draft operation) New | SAP S/4HANA | Medium | 4.3 | CVE-2026-44771 |
| 3713902 | Missing Authorization check in SAP S/4 HANA (Create Single Payment) New | SAP S/4HANA | Medium | 4.3 | CVE-2026-44770 |
| 3682699 | Path Traversal Vulnerability in SAP Fiori (launchpad) Update | SAP Fiori | Medium | 4.2 | CVE-2026-24315 |
| 3155685 | Security misconfiguration in SAP CRM (WebClient UI) New | SAP CRM | Medium | 4.1 | CVE-2026-44768 |
| 3732522 | Information Disclosure vulnerability in SAP HANA Extended Application Services classic model (User Self Service) New | SAP HANA Extended Application Services classic model | Low | 3.7 | CVE-2026-44753 |
| 3726899 | Potential vulnerability in Apache Log4j library used by SAP NetWeaver AS Java Update | SAP NetWeaver AS Java | Low | 3.3 | CVE-2025-68161 |