SAP Patches Critical S/4HANA and Commerce Cloud Vulnerabilities

SAP NetWeaver and SAP Commerce Cloud are key platforms for managing core business processes, e-commerce transactions and customer data. If their authentication mechanisms are compromised, attackers could gain excessive privileges to read or alter sensitive information, potentially disrupting business operations and threatening supply-chain security. Patching critical vulnerabilities is therefore central to risk management for companies worldwide.

SAP issued a routine security update in 2026 that patched 15 vulnerabilities across products including NetWeaver and Commerce Cloud. CVE-2026-44748 carries a CVSS score of 9.9 and could allow authentication tampering that gives unauthorized users access to data. Organizations using the affected systems should prioritize the update.

SAP Business Planning and Consolidation (BPC) is used for corporate budgeting, planning and consolidated financial reporting, while Business Warehouse (BW) centralizes the analysis of operational and warehouse data. Both systems hold highly sensitive information, and a breach could compromise the accuracy of financial statements, asset management and decision-making processes.

SAP’s routine July 2026 security update patched 19 vulnerabilities across products including BPC and BW. One of them, CVE-2026-27681, received a CVSS severity score of 9.9. Attackers could exploit the SQL injection flaw to read or alter corporate financial and warehouse data, and SAP advised IT staff to apply the patch as soon as possible.

SAP's FS-QUO manages insurance product quotes and related processes, while NetWeaver is an enterprise application integration platform. Both systems often handle core business operations and sensitive data. If their deserialization mechanisms are exploited, attackers could remotely execute code, take control of servers or steal data.

SAP released a security update on March 10 addressing 15 vulnerabilities across FS-QUO, NetWeaver and other products. Two critical flaws involve insecure deserialization and could lead to remote code execution. SAP advised affected companies to apply the patches as soon as possible to reduce the risk of system compromise.