SAP Patches Critical NetWeaver, Commerce Vulnerabilities
Source SecurityWeek
Mentioned vulnerabilities
Rated by Threat Radar
Data as of 9 Jun 2026, 12:25 UTC
What to do
AI-suggested
SAP has released official patches addressing these critical vulnerabilities. Organizations should apply the June 2026 SAP security notes promptly to remediate these issues. For CVE-2026-44748, temporarily disabling SAML authentication can mitigate the risk until patches are applied. No indication of 'no action required' or 'already mitigated' was provided by SAP, so applying official fixes is recommended. Monitor SAP advisories for updates and follow vendor guidance.
Description
SAP released security patches addressing multiple critical vulnerabilities in NetWeaver, Commerce, and Data Hub components. These flaws include an XML Signature Wrapping issue in SAML authentication, a memory corruption bug in the SAP kernel, a Spring Security HTTP header issue, and a directory traversal vulnerability in NetWeaver Application Server Java. The vulnerabilities could lead to sensitive information disclosure, memory corruption, denial-of-service, and disruption of normal system usage. Temporary mitigation for the XML Signature Wrapping flaw includes disabling SAML authentication. SAP has issued official patches for these critical issues.