by Kastro
Paper/Archive/CVE-2026-44747

CVE-2026-44747

SAP_SE SAP NetWeaver Application Server ABAP — Memory Corruption vulnerability in SAP NetWeaver Application Server ABAP

EPSS 0.6%CVSS 9.9
critical.is priorityof 100
39
CVSS 9.9 (CNA)9.9 / 10 × 3029.7Not in CISA KEV+300.0EPSS percentile 46.9.469 × 209.4No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

SAP NetWeaver Application Server ABAP allows an authenticated attacker to leverage logical errors in memory management to cause a memory corruption that could lead to unauthorized data access, modification, or system unavailability. This has high impact on confidentiality, integrity, and availability of the application.

Affected

ProductAffectedFixed inSource
SAP NetWeaver Application Server ABAPKRNL64NUC 7.22–CNA
SAP NetWeaver Application Server ABAP7.22EXT–CNA
SAP NetWeaver Application Server ABAPKRNL64UC 7.22–CNA
SAP NetWeaver Application Server ABAP7.53–CNA
SAP NetWeaver Application Server ABAPKERNEL 7.22–CNA
SAP NetWeaver Application Server ABAP7.53. 7.54–CNA
SAP NetWeaver Application Server ABAP7.77–CNA
SAP NetWeaver Application Server ABAP7.93–CNA
SAP NetWeaver Application Server ABAP9.16–CNA
SAP NetWeaver Application Server ABAP9.18–CNA
SAP NetWeaver Application Server ABAP9.19–CNA
SAP NetWeaver Application Server ABAP9.20–CNA

Scores by source

sap (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refme.sap.com/notes/3747367refurl.sap/sapsecuritypatchday