Is CVE-2026-44747 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44747 being exploited in the wild.

How severe is CVE-2026-44747?

Critical severity, with a CVSS score of 9.9, published 14 July 2026.

Which products and versions are affected?

SAP NetWeaver Application Server ABAP KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.53, KERNEL 7.22, 7.54, 7.77, 7.89, 7.93, 9.16, 9.18, 9.19, 9.20.

Is there a fix for CVE-2026-44747?

A patch was published on 2026-07-14: SAP released security note 3747367 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44747 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-44747?

Check whether you run SAP NetWeaver Application Server ABAP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44747: SAP NetWeaver AS ABAP memory corruption in memory management

CVE-2026-44747 · Severity: critical · CVSS 9.9 · Published 2026-07-14

SAP NetWeaver Application Server ABAP, a core platform for running business applications, is affected by a critical memory management vulnerability. An authenticated user can exploit this flaw to corrupt system memory, potentially leading to the theft of sensitive data, unauthorized modification of records, or a complete system shutdown. This poses a significant risk to business operations and data integrity across the SAP environment.

Technologies: SAP NetWeaver Application Server ABAP. Vendors: SAP.

Quick answers

Is CVE-2026-44747 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44747 being exploited in the wild.
How severe is CVE-2026-44747?: Critical severity, with a CVSS score of 9.9, published 14 July 2026.
Which products and versions are affected?: SAP NetWeaver Application Server ABAP KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.53, KERNEL 7.22, 7.54, 7.77, 7.89, 7.93, 9.16, 9.18, 9.19, 9.20.
Is there a fix for CVE-2026-44747?: A patch was published on 2026-07-14: SAP released security note 3747367 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44747 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44747?: Check whether you run SAP NetWeaver Application Server ABAP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A critical out-of-bounds write vulnerability (CWE-787) exists in SAP NetWeaver Application Server ABAP due to logical errors in memory management. An authenticated attacker can exploit this over the network with low complexity to trigger memory corruption. Successful exploitation allows for a scope-crossing attack that impacts the confidentiality, integrity, and availability of the entire application. The vulnerability affects multiple kernel versions including 7.22, 7.53, 7.54, and various 9.x releases. SAP has released security note 3747367 to address this issue.

Affected products

SAP NetWeaver Application Server ABAP KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.53, KERNEL 7.22, 7.54, 7.77, 7.89, 7.93, 9.16, 9.18, 9.19, 9.20

Timeline

2026-07-14: advisory: Initial publication by SAP and NVD
2026-07-14: patched: SAP released security note 3747367

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.