The Latest SAP Vulnerability: What Happened

According to The Hacker News, SAP has released patches for a serious security flaw in its NetWeaver ABAP system. This bug received a severity score of 9.9 out of 10, making it one of the most dangerous vulnerabilities disclosed in recent months. An attacker who is already logged into the system could exploit a memory corruption issue to read, change, or delete sensitive data — or even make parts of the system unavailable.

Two other critical flaws were also fixed, including one that could let an outsider send fake web requests to SAP Approuter systems, and another that left default login credentials in SAP Commerce Cloud. While none of these bugs have been reported as actively exploited yet, the risk is real for any organisation that runs SAP software.

Why This Vulnerability Matters

What makes the NetWeaver ABAP flaw especially concerning is that it requires the attacker to already have some level of access. That means the real danger often comes from inside: a careless employee, a compromised account, or a vendor with too many permissions. For Australian businesses that rely on SAP to run their finance, supply chain, and customer data, that is a worrying scenario.

The temporary workaround suggested by security researchers involves turning off certain web services in SAP. But that fix can break everyday tasks like opening transactions in SAP's graphical interface. For most companies, that is not a practical long-term option. The only solid solution is to apply the patched kernel version as soon as possible.

What This Means for Australian SMBs

Small and mid-sized businesses in Australia often run SAP on older systems or with limited IT security staff. Patch fatigue is real, and it is easy to push updates to the bottom of the to-do list. But a flaw this severe means that delaying can open the door to data theft or ransomware. Australian SMBs are frequent targets because attackers know they have fewer defences.

If your business uses SAP NetWeaver, this is not a vulnerability you can ignore. The patch is available now, and every day you wait increases the chance that an insider — or an attacker who has already breached a low-level account — could cause serious damage to your customer records, financial data, or operations.

What You Can Do Now

  • Apply the latest SAP Security Patch for July 2026 to your NetWeaver ABAP systems immediately. Check your SAP Support Portal for the relevant notes and kernel updates.
  • Audit your ICF (Internet Communication Framework) nodes in transaction SICF. Disable any node that is not essential for your daily business, but understand the trade-offs.
  • Review your SAP Commerce Cloud environment for any default or sample OAuth 2.0 clients that may still be active. Remove them and replace any hard‑coded credentials with strong, unique values.
  • Set up a monthly patch review process. If you do not have an internal team, consider working with a managed security provider to stay on top of critical updates.
  • Monitor your SAP logs for unusual login attempts or unexpected data changes. Early detection can stop a small breach from becoming a full‑scale disaster.

At MS&VG, we help Australian small and mid‑sized businesses keep their enterprise systems secure and up to date. Our team can assist with patch management, vulnerability assessments, and SAP security reviews so you can focus on running your business with confidence.