SAP Security Patch Day – July 2026

HotNews

As always, we’ll start with the HotNews notes, the highest-priority category. This month, we have 4 notes to consider in this category.

3747367 – Memory Corruption vulnerability in SAP NetWeaver Application Server ABAP

This vulnerability concerns all SICF nodes that have the interactive GUI setting active (SAP GUI for HTML). Normally, that is the tree /sap/bc/gui and all the subsides but it concerns any other with this setting active as well. The fix is provided via a kernel patch which means there is downtime involved. This is often a reason why patches are not immediately applied!. Apply the kernel patch or consider the workaround to deactivate all relevant nodes. See FAQ note 3779058 for additional information.

For SecurityBridge users: active ICF nodes can be easily found via the Security & Compliance monitor > tools > ICF Services. This is a great help to apply assess the impact of this note and to apply the workaround.

3720138 – HTTP Request Smuggling in SAP Approuter

This HTTP Request Smuggling vulnerability concerns the SAP Approuter. Perhaps a component that is not too familiar for technical administrators. Nevertheless, the Approuter often plays a vital role in BTP connectivity and this vulnerability can have a large impact on confidentially and availability. In this case, Approuters are affected that do not run in Cloud Foundry. See note 3770203 for additional information concerning XSUAA.

Make sure to update relevant Approuter deployments with the updated Node.js package.

3753495 – Insecure Sample Credentials in SAP Commerce Cloud

This vulnerability is catalogued as a ‘documentation error’ but make no mistake, it is a HotNews note for a reason! On SAP Commerce Cloud, a sample OAuth2 client may exist with a well-known set of credentials that gives access to the system. This client may be there because of delivered scripts. Make sure the client trusted_client does not exist or has at least updated (not-well known) credentials. See FAQ note 3758007 for additional information.

3727078 – Directory Traversal vulnerability in SAP NetWeaver Application Server Java (Web Container)

The note has earlier released and now updated with support package and patch information. Check if this update applies to your landscape now.

High-Priority Notes

Next up is the High Priority category. A level lower than HotNews but no reason to consider these notes as unimportant. There are 6 notes in this category this month, see the highlights below:

3758101 – Multiple vulnerabilities in Apache Camel within SAP Integration Suite (Edge Integration Cell)

Various vulnerabilities have been found in Apache Camel, which is the foundation for SAP Cloud Integration. As a PaaS offering, these vulnerabilities are taken care off by SAP in Cloud Integration but for the Edge Integration Cell, the updated version of Integration Cell needs to be applied by the customer. There is a workaround available but the update is – as always – the way to go forward.

3692165 – DLL Hijacking vulnerability in SAProuter on Microsoft Windows

The SAPRouter component exists already for a long time in SAP landscapes and facilitates RFC traffic. A vulnerability has been found that allows DLL hijacking. It is relevant for Windows-based SAPRouter installations (obviously) and requires an updated version of the SAPRouter. 

The note also advises other security measures which are very relevant to consider!

3763800 – Multiple vulnerabilities in Apache Tomcat within SAP Commerce Cloud

Various vulnerabilities have been found on SAP Commerce Cloud which are all related to the Apache Tomcat server that is used underneath. See the note for the instructions on how to update for either Public Cloud or on-premise situations. Workaround are available. See FAQ note 3768608 for additional information.

3741519 – Open Redirect vulnerability in SAP Approuter

The Approuter was already subject to one of the HotNews security notes. But also for this redirect vulnerability. Make sure to update to the mentioned version. But also: configure the redirect-urls in a strict way as mentioned by the note. This is a manual activity!

3773304 – Remote Code Execution vulnerability in SAP Change and Transport System Attach Tool (ctsattach)

The ctsattach tool has a deserialization issue which may lead to remote code execution. The tool is no longer available and should no longer be used. Make sure to delete all versions of it according to the note. See note 2473648 for additional information.

 

Medium- and Low-Priority Notes

As we see almost every patch cycle, the majority of security notes fall into the Medium or Low category. This time 8 and 2 respectively. These issues can typically be resolved by simply applying the supplied patches. We highlight additional key findings below, and for a full breakdown, please scroll to the end of this post.

3732522 – Information Disclosure vulnerability in SAP HANA Extended Application Services classic model (User Self Service)

This vulnerability concerns the User Self Service in a HANA XS classic setup. Apply the patch (preferred) or disable the user self service functionality as a workaround.