SAP Patches Critical NetWeaver, Commerce Vulnerabilities

Why It Matters

The patches close high‑impact attack vectors that could expose sensitive enterprise data or disrupt critical business applications, underscoring the urgency for SAP customers to apply updates promptly.

Key Takeaways

• CVE-2026-44748 allows authenticated SAML signature tampering (CVSS 9.9)
• CVE-2026-27671 exploits RFC validation, enabling unauthenticated memory corruption
• CVE-2026-22732 impacts Spring Security headers in Commerce Cloud
• CVE-2026-40128 directory traversal lets attackers access files via Java web container
• SAP released 15 security notes covering NetWeaver, Commerce, Data Hub

Pulse Analysis

SAP’s June 2026 security patch day highlights the growing complexity of enterprise software risk. NetWeaver, the backbone of many SAP installations, has historically been a target for sophisticated attacks; recent high‑profile breaches have demonstrated how a single flaw can cascade across thousands of on‑premise and cloud environments. By issuing 15 security notes, SAP signals a proactive stance, yet the sheer volume of patches also reflects the challenge of maintaining a monolithic codebase in an era of rapid digital transformation.

The three critical vulnerabilities disclosed illustrate distinct threat vectors. CVE‑2026‑44748 exploits XML Signature Wrapping in SAML authentication, allowing attackers with ordinary credentials to forge identity assertions—a scenario that could compromise single‑sign‑on integrations and expose confidential data. CVE‑2026‑27671’s memory‑corruption bug bypasses authentication entirely, leveraging malformed RFC packets to destabilize the kernel, while CVE‑2026‑22732 targets Spring Security header handling, potentially weakening web‑application defenses in Commerce Cloud. Together, these issues underscore the need for layered security controls, including temporary SAML deactivation, strict network segmentation, and rigorous monitoring of authentication flows.

For SAP customers, the patches are a reminder that timely remediation is non‑negotiable. Organizations should integrate SAP’s security notes into their change‑management pipelines, validate mitigations in test environments, and consider compensating controls such as intrusion‑detection signatures and least‑privilege access models. Beyond immediate fixes, the episode reinforces a broader industry trend: vendors and enterprises must adopt continuous vulnerability‑management programs and invest in automated patch‑deployment tools to stay ahead of increasingly sophisticated threat actors.