CVE-2026-44747
CriticalCVSS 9.9Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
An authenticated attacker can exploit logical errors in memory management in SAP NetWeaver Application Server ABAP, causing memory corruption. This could lead to unauthorized data access, modification, or system unavailability.
Risk Assessment
The vulnerability has a high impact on the confidentiality, integrity, and availability of the application, potentially resulting in sensitive data leakage, data manipulation, or system downtime.
Recommendation
Apply the security patch provided by SAP in the corresponding security note immediately. Restricting system access to trusted users can reduce the risk.
Other vulnerabilities in SAP NetWeaver Application Server ABAP
See all- CVE-2026-34265Critical
SAP NetWeaver Application Server ABAP is vulnerable to logical errors in DIAG protocol parsing, allowing an unauthenticated attacker to cause memory corruption. This could potentially disclose sensitive system information or crash the system, leading to high impact on confidentiality, integrity, and availability.
- CVE-2026-44748Critical
SAP NetWeaver Application Server ABAP and ABAP Platform allow an authenticated attacker with normal privileges to obtain a valid signed message and send modified signed XML documents to the verifier. This may result in acceptance of tampered identity information, leading to unauthorized access to sensitive user data and potential disruption of normal system usage.
- CVE-2026-66779Medium
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP. An authenticated attacker can create a malicious link and make it publicly accessible. When an authenticated victim clicks the link, the injected input is processed and reflected in the DOM on the client side, leading to execution of malicious content in the victim's browser.
- CVE-2026-44760Medium
A Cross-Site Scripting (XSS) vulnerability in the Business Server Pages framework of SAP NetWeaver Application Server ABAP reflects unsanitized input into HTTP responses, allowing an attacker to inject and execute arbitrary JavaScript code. Successful exploitation could lead to session theft and unauthorized actions on behalf of the victim.
Original NVD description (English source)
SAP NetWeaver Application Server ABAP allows an authenticated attacker to leverage logical errors in memory management to cause a memory corruption that could lead to unauthorized data access, modification, or system unavailability. This has high impact on confidentiality, integrity, and availability of the application.