12 articles · Latest technology news, analysis, and reporting.
SAP released 16 security notes on July 14 including a CVSS 9.9 memory corruption vulnerability in NetWeaver AS ABAP. A low-privileged authenticated attacker can exploit it to access or corrupt data, or crash affected systems. Two more critical flaws in Approuter and Commerce Cloud round out a patch day that demands immediate attention from SAP administrators.
Skyroot Aerospace launched Vikram-1 from Sriharikota on July 18 — the first orbital rocket ever developed by a private Indian company. Named Mission Aagaman, the flight targets a 450 km orbit and carries payloads from Indian and international companies. Nearly 3,000 days of work came down to this.
SAP July 2026 Security Patch Day addresses 19 security notes including a CVSS 9.9 memory corruption flaw (CVE-2026-44747) in NetWeaver AS ABAP, plus critical bugs in Approuter and Commerce Cloud. Enterprise security teams are urged to patch immediately as AI-assisted exploits can appear within hours of disclosure.
SAP released 16 security notes on July 14, 2026. CVE-2026-44747 (CVSS 9.9) is a memory corruption bug in NetWeaver AS ABAP affecting kernel versions 7.22-9.20. Two more critical flaws affect Approuter and Commerce Cloud. No active exploitation confirmed yet.
SAP's July 2026 Patch Day addressed three critical vulnerabilities including CVE-2026-44747 (CVSS 9.9), a memory corruption flaw in NetWeaver AS ABAP, and two unauthenticated attack vectors in Approuter and Commerce Cloud. With CISA's exploited vulnerabilities catalog showing 14 SAP entries since 2021, security teams should treat this cycle as urgent.
On April 29, 2026, four core SAP CAP npm packages were compromised in a supply chain attack dubbed Mini Shai-Hulud. The malware stole cloud credentials and self-propagated through developers' own pipelines, eventually hitting 373 malicious package versions across 169 npm packages.
On April 29, 2026, four official SAP npm packages were poisoned with credential-stealing malware. Within hours, over 1,800 developer repositories were compromised. Here is what happened, how it spread, and what every SAP development team needs to do now.
On April 29, 2026, four SAP npm packages central to the Cloud Application Programming Model were poisoned with credential-stealing malware for a two-to-four-hour window, hitting over 1,800 developers. The campaign, attributed to TeamPCP, marks the first Shai-Hulud worm incursion into SAP core development libraries.
SAP released 15 security notes on June 9, 2026, with four critical vulnerabilities. The worst, CVE-2026-44748 (CVSS 9.9), is an XML Signature Wrapping flaw in SAML authentication that lets an attacker forge identity across an entire SAP landscape. A second CVSS 9.8 flaw allows unauthenticated memory corruption in the ABAP kernel via RFC requests.
AI tools can now reverse-engineer SAP patches and generate working exploits in hours. Combined with the Mini Shai-Hulud supply chain attack and a string of CVSS 9.9 vulnerabilities in 2026, SAP organizations face a threat timeline unlike anything in the past.
On April 29, 2026, threat group TeamPCP poisoned four core SAP npm packages used by 572,000 developers weekly, injecting credential-stealing malware that harvested GitHub tokens, cloud secrets, and CI/CD pipeline credentials. Here is what happened, how it worked, and what enterprise security teams need to do now.
SAP's June 2026 Patch Day delivered four critical vulnerabilities including a CVSS 9.9 SAML authentication bypass that lets attackers forge identity assertions across any NetWeaver ABAP system using single sign-on. A second flaw at CVSS 9.8 allows unauthenticated remote code execution with no available workaround.
Explore other topics
Stay informed across every section of TozenNews.