SAP warns of critical flaws in NetWeaver and Commerce Cloud

SAP has released its July 2026 security updates addressing 16 vulnerabilities across multiple products, including three critical flaws in NetWeaver, AppRouter, and Commerce Cloud. The critical vulnerabilities include a memory corruption issue in NetWeaver AS ABAP, an HTTP request smuggling flaw in AppRouter, and a default credentials issue in Commerce Cloud that could allow unauthorized data access. While no active exploitation has been observed yet, CISA has previously cataloged SAP vulnerabilities as exploited, and recent supply chain attacks highlight ongoing risks.

AI-extracted · verify before operational use