Full Report
SAP has released fixes for 15 vulnerabilities as part of its June 2026 Security Patch package, including four critical-severity flaws affecting SAP NetWeaver and SAP Commerce Cloud. [...]
Analysis Summary
# Vulnerability: SAP June 2026 Security Patch Day (Critical Flaws)
## CVE Details
- **CVE ID:** CVE-2026-44748, CVE-2026-27671, CVE-2026-22732, CVE-2026-40128
- **CVSS Score:** 9.0 to 9.9 (Critical)
- **CWE:**
- CVE-2026-44748: CWE-347 (Improper Verification of Cryptographic Signature)
- CVE-2026-27671: CWE-119 (Memory Corruption)
- CVE-2026-40128: CWE-22 (Directory Traversal)
## Affected Systems
- **Products:**
- SAP NetWeaver AS ABAP and ABAP Platform
- SAP NetWeaver Application Server Java (Web Container)
- SAP Commerce Cloud (formerly Hybris)
- SAP Data Hub
- **Versions:** Multiple versions across the NetWeaver and Commerce Cloud stacks.
- **Configurations:**
- CVE-2026-44748 specifically impacts SAML-based authentication environments.
- CVE-2026-27671 impacts systems with RFC (Remote Function Call) endpoints exposed.
## Vulnerability Description
- **CVE-2026-44748 (CVSS 9.9):** An XML Signature Wrapping flaw. Authenticated attackers can obtain a signed message and modify XML documents sent to the verifier, potentially bypassing authentication or escalating privileges by tampering with identity information.
- **CVE-2026-27671 (CVSS 9.8):** A memory corruption flaw due to improper kernel validation. Unauthenticated attackers can send crafted RFC requests to trigger the corruption.
- **CVE-2026-22732 (CVSS 9.1):** A vulnerability related to Spring Security integration within Commerce Cloud and Data Hub.
- **CVE-2026-40128 (CVSS 9.0):** A directory traversal vulnerability in the SAP NetWeaver AS Java Web Container allowing unauthorized access to files.
## Exploitation
- **Status:** No reports of exploitation in the wild as of the release date.
- **Complexity:** Low to Medium.
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** High (Unauthorized access to sensitive user and system data).
- **Integrity:** High (Ability to tamper with identity information and system files).
- **Availability:** High (Potential for system disruption or crashes via memory corruption).
## Remediation
### Patches
SAP has released specific Security Notes for each CVE within the June 2026 patch cycle. Customers must log in to the SAP Support Portal to download the specific support packages and kernel updates.
- **Priority 1:** Apply patches for CVE-2026-44748 (SAML bypass) and CVE-2026-27671 (RFC memory corruption).
### Workarounds
- Limit network access to RFC destinations and SAML assertion consumers.
- Disable unused services in NetWeaver AS Java to reduce the attack surface for directory traversal.
- Detailed workarounds are restricted to customers via the SAP Security Notes portal.
## Detection
- **Indicators of Compromise:** Unusual SAML log-in patterns or unexpected modifications to XML identity tokens; logs showing malformed or highly frequent RFC requests.
- **Detection methods and tools:**
- Review SAP Security Audit Logs (SAL).
- Monitor for Directory Traversal attempts in HTTP access logs of the NetWeaver Java Web Container.
## References
- hxxp[://]support[.]sap[.]com/en/my-support/knowledge-base/security-notes-news/june-2026[.]html
- hxxp[://]www[.]cve[.]org/CVERecord?id=CVE-2026-44748
- hxxp[://]www[.]cve[.]org/CVERecord?id=CVE-2026-27671