What is the CVSS score of CVE-2026-44747?

CVE-2026-44747 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.4%.

Which versions of Sap Netweaver Application Server Abap are affected by CVE-2026-44747?

SAP NetWeaver Application Server ABAP installations face a critical vulnerability (CVE-2026-44747, CVSS 9.9) allowing authenticated users to access restricted data, corrupt business records, or force…

How to fix or mitigate CVE-2026-44747?

Within 24 hours, identify and catalog all production and development SAP NetWeaver ABAP instances, audit which users hold authentication credentials, and revoke or strictly limit access permissions for non-critical accounts; simultaneously activate detailed logging of database transactions and system-level API calls to generate forensic evidence if exploitation occurs. Within seven days, implement network segmentation to isolate ABAP servers from general corporate networks, deploy intrusion detection rules targeting memory corruption signatures, and configure real-time alerts for system crashes, memory access violations, or suspicious query patterns. Within 30 days, establish a daily process to monitor SAP Security Notes for patch availability, pre-stage the update in a non-production environment for validation, and develop an emergency deployment procedure that can execute a production rollout within four hours of patch release; in parallel, review user access policies to limit the number of accounts capable of triggering the vulnerability.

Sap Netweaver Application Server Abap CVE-2026-44747

EUVD-2026-43586 CRITICAL

Out-of-bounds Write (CWE-787)

2026-07-14 sap

GHSA-wpx3-vvrc-3w8m

Buffer Overflow Memory Corruption SAP Sap Netweaver Application Server Abap Sap Se

9.9

CVSS 3.1 · Vendor: sap

Severity by source

Vendor (sap) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (sap) · only source for this CVE.

CVSS VectorVendor: sap

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 01:17 vuln.today

CVE Published

Jul 14, 2026 - 00:19 cve.org

CRITICAL 9.9

DescriptionCVE.org

SAP NetWeaver Application Server ABAP allows an authenticated attacker to leverage logical errors in memory management to cause a memory corruption that could lead to unauthorized data access, modification, or system unavailability. This has high impact on confidentiality, integrity, and availability of the application.

Articles & Coverage 1

News Critical Memory Corruption in SAP NetWeaver AS ABAP - CVE-2026-44747 Jul 14, 2026

AnalysisAI

Memory corruption in SAP NetWeaver Application Server ABAP lets an authenticated attacker exploit logical flaws in memory management (an out-of-bounds write) to read or alter data and crash the system, with high impact on confidentiality, integrity, and availability. SAP rates it CVSS 9.9 with a changed scope, meaning a low-privileged user can affect components beyond their own authorization boundary. There is no public exploit identified at time of analysis, but the low attack complexity and network reachability make it a high-priority patch for any exposed ABAP stack.