SAP SE - CraftedSignal Threat Feed

CVE-2026-44752: SAP NetWeaver Application Server Java Cross-Site Scripting Vulnerability

hello@craftedsignal.io — Tue, 14 Jul 2026 01:21:17 +0000

A critical client-side cross-site scripting (XSS) vulnerability, identified as CVE-2026-44752, has been discovered in SAP NetWeaver Application Server Java, specifically affecting Configuration Wizard (LMCTC 7.50). This vulnerability allows an unauthenticated attacker to inject arbitrary malicious JavaScript code into a crafted URL. When a victim accesses this malicious URL, the embedded script executes within their browser in the context of the vulnerable SAP application. This client-side execution grants the attacker the ability to access and potentially exfiltrate sensitive session-related information, such as cookies or session tokens, and to modify non-sensitive data displayed to the user. The exploitation leads to a high impact on confidentiality and a low impact on integrity, with no impact on the availability of the application.

Attack Chain

Malicious URL Crafting: An unauthenticated attacker identifies a vulnerable SAP NetWeaver Application Server Java instance that improperly sanitizes URL input. The attacker crafts a malicious URL containing injected JavaScript code designed to perform actions within the victim's browser.
Victim Enticement: The attacker distributes the crafted URL to a potential victim, typically employing social engineering tactics such as phishing emails, instant messages, or compromised websites, to persuade the victim to click the malicious link.
Client-Side Request: Upon clicking the link, the victim's web browser sends an HTTP request containing the crafted URL to the vulnerable SAP NetWeaver Application Server Java.
Vulnerable Server Response: The SAP NetWeaver Application Server Java, due to CVE-2026-44752, processes the crafted URL and incorporates the attacker's malicious JavaScript directly into the HTML response without adequate sanitization.
Malicious Script Execution: The victim's web browser receives the server's response and executes the embedded malicious JavaScript within the security context of the legitimate SAP NetWeaver Application Server Java domain.
Session Information Exfiltration: The executed JavaScript accesses and exfiltrates sensitive session information, such as authentication cookies, session tokens, or other client-side credentials, back to an attacker-controlled server.
Impersonation and Data Manipulation: The attacker utilizes the stolen session information to hijack the victim's session, impersonate the victim within the SAP application, or manipulate non-sensitive data displayed in the victim's browser, potentially leading to unauthorized actions.

Impact

Successful exploitation of CVE-2026-44752 allows an attacker to compromise the confidentiality of user sessions by stealing sensitive data like authentication tokens or cookies. This could lead to unauthorized access to the victim's SAP application session. While the integrity impact is described as low, an attacker can modify non-sensitive data displayed in the victim's browser, which could be used for further deception or targeted attacks. There is no direct impact on the availability of the SAP NetWeaver application itself. The lack of authentication required for exploitation makes this a significant risk.

Recommendation

Patch CVE-2026-44752 on all affected SAP NetWeaver Application Server Java instances immediately by applying the updates referenced in SAP Security Note 3748227.
Implement robust content security policies (CSPs) on web servers hosting SAP NetWeaver to mitigate client-side script injection risks, even if server-side sanitization fails.
Educate users on identifying and avoiding suspicious URLs and phishing attempts to prevent them from accessing crafted malicious links.

Unauthenticated Arbitrary Code Execution in SAProuter via DLL Hijacking (CVE-2026-0487)

hello@craftedsignal.io — Tue, 14 Jul 2026 01:20:05 +0000

CVE-2026-0487 describes a critical vulnerability in SAProuter on Microsoft Windows, allowing an unauthenticated attacker to achieve arbitrary code execution through DLL hijacking. The flaw enables the router to load library (DLL) files from untrusted locations, which an attacker can exploit to execute malicious code. This vulnerability, stemming from an uncontrolled search path element (CWE-427), has a CVSS v3.1 base score of 8.4, indicating a high impact on the confidentiality, integrity, and availability of the affected system. Multiple versions of SAProuter are impacted, including KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.53, SAP_ROUTER 7.53, 7.54, KERNEL 7.22, 7.77, 7.89, 7.93, 9.16, 9.17, and 9.18. Organizations using vulnerable SAProuter versions on Windows should prioritize patching to mitigate this severe risk.

Attack Chain

Initial Access: An unauthenticated attacker gains network access to the target system running SAProuter.
Vulnerability Identification: The attacker identifies an untrusted or non-standard directory within SAProuter's DLL search path that can be written to, either due to inherent design flaws (CWE-427) or another vulnerability.
Malicious DLL Placement: The attacker places a specially crafted malicious DLL (e.g., ws2_32.dll impersonation, or other known loadable DLLs) into the identified untrusted directory.
Legitimate Operation Trigger: When the SAProuter process performs an action that requires loading a legitimate system DLL (e.g., during startup or routine operations), its uncontrolled search path prioritizes the untrusted directory.
Malicious DLL Loading: SAProuter, unaware of the malicious intent, loads and attempts to execute the attacker's DLL instead of the legitimate one.
Arbitrary Code Execution: The malicious code embedded within the attacker's DLL is executed within the security context of the SAProuter process, allowing the attacker to gain full control over the process and potentially the underlying system.
Impact: The attacker can then perform various post-exploitation activities, such as establishing persistence, exfiltrating sensitive data, or deploying additional malware.

Impact

Successful exploitation of CVE-2026-0487 allows an unauthenticated attacker to achieve arbitrary code execution on the compromised system. This leads to a severe impact on the confidentiality, integrity, and availability of the system where SAProuter is installed. Attackers can gain full control over the affected SAProuter process, potentially leading to unauthorized access to SAP systems, data manipulation, or denial-of-service conditions. Given the critical role of SAProuter in connecting SAP systems to external networks, a compromise could have widespread implications for an organization's business operations and data security. The specific number of potential victims or targeted sectors is not provided, but any organization using vulnerable SAProuter versions on Microsoft Windows is at risk.

Recommendation

Patch CVE-2026-0487: Immediately apply the security patches provided by SAP SE, referenced by SAP Note 3692165 and the SAP Security Patch Day updates.
Monitor for Suspicious DLL Loading: Deploy the provided Sigma rule to your SIEM to detect SAProuter.exe loading DLLs from unusual or non-standard paths, which could indicate exploitation attempts of CVE-2026-0487.
Enable Sysmon Event ID 7: Ensure Sysmon Event ID 7 (ImageLoad) logging is enabled on all Windows systems running SAProuter to capture DLL loading activities required by the detection rule.
Review SAProuter Configurations: Regularly audit SAProuter configurations to ensure that its DLL search paths do not include user-writable or untrusted locations.

Exploitation of CVE-2026-44747 in SAP NetWeaver ABAP via Memory Corruption

hello@craftedsignal.io — Tue, 14 Jul 2026 01:18:54 +0000

CVE-2026-44747 details a critical vulnerability impacting SAP NetWeaver Application Server ABAP across multiple kernel versions, including KRNL64NUC 7.22, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 9.16, 9.18, 9.19, and 9.20. This flaw, categorized as an out-of-bounds write (CWE-787), allows an authenticated attacker to trigger logical errors within the application's memory management. Successful exploitation results in memory corruption, enabling attackers to gain unauthorized access to sensitive data, modify existing data, or disrupt the availability of the SAP application. The vulnerability poses a significant risk to organizations using affected SAP NetWeaver ABAP systems, with a CVSS v3.1 Base Score of 9.9, indicating high impact on confidentiality, integrity, and availability.

Attack Chain

Initial Access: An attacker first obtains valid credentials to an affected SAP NetWeaver Application Server ABAP instance through various means, such as credential compromise or insider threats.
Vulnerability Exploitation: The authenticated attacker crafts and sends specific inputs or requests that target logical errors in the server's memory management functions.
Memory Corruption Trigger: These crafted inputs cause an out-of-bounds write (CWE-787) within the SAP NetWeaver ABAP application's memory space, leading to memory corruption.
Unauthorized Data Access: The attacker leverages the corrupted memory to read sensitive or confidential data stored within the application's process memory.
Data Modification: Alternatively, the attacker may write to unauthorized memory locations to alter critical application data, configurations, or system parameters.
System Unavailability: In severe cases, the memory corruption can lead to the instability, crash, or complete denial of service for the SAP NetWeaver Application Server ABAP instance.

Impact

Successful exploitation of CVE-2026-44747 has a severe impact on the affected SAP NetWeaver Application Server ABAP. Attackers can achieve unauthorized access to confidential business data, modify crucial operational information, or render the system completely unavailable. This directly compromises the confidentiality, integrity, and availability of critical business processes and data managed by the SAP system. For organizations relying on these systems, this could lead to significant financial losses, operational disruption, regulatory penalties, and reputational damage.

Recommendation

Patch CVE-2026-44747 on all affected SAP NetWeaver Application Server ABAP instances immediately by applying the security updates provided by SAP SE, as referenced in the SAP security notes.
Implement strong authentication policies and monitor for unusual login attempts to mitigate the "authenticated attacker" component of the attack chain.

SAP Approuter HTTP Request Smuggling Vulnerability Allows Confidentiality and Availability Impact (CVE-2026-27690)

hello@craftedsignal.io — Tue, 14 Jul 2026 01:17:56 +0000

SAP Approuter, specifically versions older than 20.10.0 of its Node.js package, is affected by a critical HTTP Request Smuggling vulnerability, identified as CVE-2026-27690 (CWE-444). This flaw allows an unauthenticated attacker to manipulate HTTP requests, leading to request-response desynchronization between a frontend proxy/load balancer and the backend Approuter server. By exploiting this desynchronization, an attacker can expose sensitive user responses, compromising confidentiality. Furthermore, the vulnerability can also be leveraged to trigger internal server errors or resource exhaustion, effectively rendering the system unavailable and leading to a denial of service. The vulnerability has a CVSS v3.1 base score of 9.1, indicating a severe risk to affected deployments.

Attack Chain

An unauthenticated attacker identifies an internet-facing SAP Approuter instance vulnerable to HTTP Request Smuggling.
The attacker crafts a malicious HTTP request that uses conflicting methods for determining message length (e.g., Content-Length and Transfer-Encoding: chunked) to exploit differences in how a frontend proxy/load balancer and the backend Approuter server process the request.
The frontend proxy/load balancer processes the request according to one method, while the backend SAP Approuter interprets it using another, leading to a desynchronized state.
The attacker's "smuggled" request or parts of it are left in the connection buffer on the backend server, where it gets prepended to subsequent legitimate user requests.
This can result in the attacker intercepting and exfiltrating sensitive data contained in responses intended for legitimate users.
Alternatively, the desynchronization and malformed requests can cause the Approuter to encounter errors, deplete resources, or crash.
This leads to the SAP Approuter application becoming unresponsive and unavailable to legitimate users, resulting in a denial of service.

Impact

The successful exploitation of CVE-2026-27690 can have severe consequences for organizations utilizing SAP Approuter. Attackers can gain unauthorized access to sensitive user data, including session tokens, credentials, or other confidential information transmitted through the application. This directly compromises the confidentiality of user interactions. Additionally, the vulnerability can be weaponized to perform denial-of-service attacks, making the SAP Approuter application inaccessible to legitimate users. This impacts business operations, disrupts critical processes, and can lead to significant financial and reputational damage.

Recommendation

Prioritize patching SAP Approuter instances to mitigate CVE-2026-27690 immediately. Apply the update referenced in the SAP security notes mentioned below to ensure SAP Approuter Node.js package versions are 20.10.0 or higher.
Regularly consult SAP's security patch day advisories via the https://url.sap/sapsecuritypatchday reference to stay informed about critical updates.