SAP's June 2026 security update addresses 15 security notes, including four critical vulnerabilities affecting NetWeaver, Commerce, and Data Hub. The most severe is CVE-2026-44748, an XML Signature Wrapping vulnerability in SAML Authentication of NetWeaver AS ABAP and ABAP Platform, allowing authenticated attackers to tamper with signed XML identity information and gain unauthorized access. CVE-2026-27671 is a memory corruption vulnerability in the SAP kernel due to improper validation of the RFC protocol, enabling unauthenticated attackers to exploit logic errors in memory management. CVE-2026-22732 affects applications using the Spring Security framework, potentially causing HTTP headers not to be written properly. CVE-2026-40128 is a directory traversal vulnerability in NetWeaver Application Server Java (Web Container) that allows unauthenticated attackers to manipulate file inclusion parameters to access sensitive data or cause denial-of-service. SAP also patched multiple Apache Tomcat flaws and an authorization check issue in NetWeaver and ABAP Platform. Temporary mitigation for CVE-2026-44748 includes disabling SAML authentication. Official patches have been released by SAP.

Exploitation of these vulnerabilities can lead to unauthorized disclosure of sensitive information, memory corruption, denial-of-service conditions, and disruption of normal system operations. The XML Signature Wrapping flaw allows attackers to modify signed identity information, potentially gaining unauthorized access to sensitive user data. Memory corruption vulnerabilities may allow attackers to execute arbitrary code or crash services. Directory traversal can expose sensitive files or cause service disruption. The Spring Security flaw may result in improper HTTP header handling, affecting application security.

SAP has released official patches addressing these critical vulnerabilities. Organizations should apply the June 2026 SAP security notes promptly to remediate these issues. For CVE-2026-44748, temporarily disabling SAML authentication can mitigate the risk until patches are applied. No indication of 'no action required' or 'already mitigated' was provided by SAP, so applying official fixes is recommended. Monitor SAP advisories for updates and follow vendor guidance.