Critical Memory Corruption Flaw Disclosed in SAP NetWeaver AS ABAP

SAP disclosed CVE-2026-44747, a critical memory corruption vulnerability in SAP NetWeaver Application Server ABAP, and published remediation guidance in Security Note 3747367 as part of its Security Patch Day materials. The flaw is classified as CWE-787 and affects multiple SAP ABAP kernel releases, including KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, and 9.16 through 9.20.

The vulnerability can be exploited remotely by an authenticated attacker with low privileges and carries a CVSS v3.1 score of 9.1 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H). Successful exploitation could cause unauthorized data access, data modification, privilege escalation, or system unavailability. Public reporting said there was no confirmed active exploitation at the time of disclosure, but the impact profile makes patching affected SAP environments a priority.