Daily Threat Briefing
← All briefings

SAP NetWeaver Application Server ABAP · ServiceNow AI Platform · SAP Approuter

Daily Threat Intelligence Briefing

Date: 2026-07-14 Prepared for: SOC Analysts | Incident Responders | Vulnerability Management | Security Leadership

Executive Summary

Today’s most significant new developments are a critical memory corruption flaw in SAP NetWeaver AS ABAP (CVE-2026-44747, CVSS 9.9) and an HTTP request smuggling vulnerability in SAP Approuter (CVE-2026-27690, CVSS 9.1), both published on SAP’s July 2026 Patch Day. A new unauthenticated RCE in ServiceNow’s AI Platform (CVE-2026-6875, CVSS 9.5) affects widely deployed enterprise ITSM infrastructure. CISA and allied agencies issued a joint advisory on active Russian FSB (Center 16) exploitation of poorly configured routers targeting critical infrastructure. The EU and UK jointly sanctioned Russian GRU-linked hacking groups.

Critical Vulnerabilities

CVE-2026-44747 — SAP NetWeaver Application Server ABAP

  • Severity: CVSS 9.9
  • EPSS: 0 (newly published; no exploitation data yet)
  • Technical detail: A logical error in memory management allows an authenticated attacker to trigger memory corruption, potentially leading to unauthorized data access, data modification, or further system compromise. Affects a broad range of kernel versions (KRNL64NUC/KRNL64UC 7.22, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 9.16–9.20). SAP NetWeaver ABAP is pervasive in European enterprise environments, particularly in manufacturing, finance, and public sector. The near-maximum CVSS score and wide version range make this a high-priority patch target.
  • Exploitation status: No confirmed in-the-wild exploitation at time of writing.
  • Remediation: Apply SAP July 2026 Security Patch Day notes immediately. Prioritize internet-facing and production ABAP systems. Review SAP Security Note for this CVE via the SAP Support Portal.

CVE-2026-6875 — ServiceNow AI Platform (Unauthenticated RCE)

  • Severity: CVSS 9.5
  • EPSS: 0 (newly published)
  • Technical detail: An unauthenticated remote code execution vulnerability in the ServiceNow AI Platform allows an unauthenticated user to execute arbitrary code under certain circumstances. Affected versions include all releases prior to Yokohama Patch 12 Hot Fix 1b, Yokohama Patch 13, Zurich Patch 7b, Zurich Patch 9, Australia Patch 2, Brazil GA, and Brazil EA. ServiceNow is widely deployed as an enterprise ITSM and workflow platform; unauthenticated RCE in this context represents a critical risk to business operations and sensitive data.
  • Exploitation status: No confirmed exploitation; high-value target given enterprise prevalence.
  • Remediation: Apply the relevant patched release for your ServiceNow instance immediately. Verify patch level via the ServiceNow instance upgrade dashboard. Restrict external access to ServiceNow instances where possible pending patching.

CVE-2026-27690 — SAP Approuter (HTTP Request Smuggling)

  • Severity: CVSS 9.1
  • EPSS: 0 (newly published)
  • Technical detail: An HTTP Request Smuggling vulnerability in the SAP Approuter Node.js package (versions below 20.10.0) allows an unauthenticated attacker to send a specially crafted HTTP request causing request-response desynchronization. This can lead to cache poisoning, session hijacking, or bypassing security controls in front-end routing layers. SAP Approuter is commonly used as the entry point for SAP BTP (Business Technology Platform) applications.
  • Exploitation status: No confirmed exploitation.
  • Remediation: Upgrade the @sap/approuter npm package to version 20.10.0 or later. Review BTP application routing configurations for anomalies.

CVE-2026-44761 — SAP Commerce Cloud (Default OAuth2 Credentials)

  • Severity: CVSS 9.1
  • EPSS: 0 (newly published)
  • Technical detail: SAP Commerce Cloud may retain a sample OAuth2 client with publicly documented default credentials from SAP Help Portal documentation. If left unchanged, an attacker with knowledge of these credentials can authenticate as that client and potentially access protected resources. Affects versions COM_CLOUD 2211, 2211-JDK21, and HY_COM 2205.
  • Exploitation status: No confirmed exploitation; default credential abuse is trivially weaponizable.
  • Remediation: Immediately audit SAP Commerce Cloud OAuth2 client configurations. Remove or rotate any sample/default credentials. Apply SAP July 2026 patch notes.

CVE-2008-4128 — Cisco IOS (CISA KEV — Due 2026-07-16)

  • Severity: CVSS not specified (CSRF)
  • EPSS: N/A
  • Technical detail: Multiple CSRF vulnerabilities in Cisco IOS 12.4 allow remote attackers to execute arbitrary commands via crafted requests to the HTTP management interface (/level/15/exec/- and /level/15/exec/-/configure/http URIs). While the CVE is from 2008, CISA’s addition to KEV confirms active exploitation against legacy infrastructure. Cisco IOS 12.4 is end-of-life; affected devices are likely unpatched legacy routers — directly relevant given the concurrent Russian FSB router-targeting advisory.
  • Exploitation status: Actively exploited (CISA KEV, added 2026-07-13).
  • Remediation: Federal agencies must remediate by 2026-07-16. All organizations: disable HTTP management interfaces on IOS devices (no ip http server), migrate to supported IOS/IOS-XE versions, and enforce network-level access controls on management interfaces.

ONGOING:

  • CVE-2026-56271 (Flowise hardcoded JWT): upgrade to 3.1.0, rotate secrets; Metasploit module for co-product CVE-2026-41264 still publicly available.
  • CVE-2026-58596 / CVE-2026-58281 (Microsoft Edge): update to 150.0.4078.48 if not yet applied.
  • CVE-2026-48939 / CVE-2026-56291 (Joomla iCagenda/Balbooa): actively exploited; patch deadline passed — treat unpatched instances as compromised.
  • CVE-2026-55255 (Langflow): actively exploited; patch immediately.
  • CVE-2026-8037 (Progress Kemp LoadMaster): actively exploited; patch or isolate.
  • CVE-2026-46817 (Oracle E-Business Suite): actively exploited; patch immediately.
  • CVE-2026-48282 / CVE-2026-48316 (Adobe ColdFusion): actively exploited; patch or isolate.

European Advisories

BSI WID — July 13–14, 2026: BSI published a high volume of advisories. New advisories of note:

BSI also updated advisories for Apache Camel, Linux Kernel (multiple), NGINX/NGINX Plus, ImageMagick, X.Org/Xwayland, Mozilla Firefox/ESR/Thunderbird, OWASP ModSecurity, Red Hat Enterprise Linux (openexr, urllib3), GraphicsMagick, and Kyverno. Apply available vendor patches for all affected components.

Lidl Data Breach (Germany/Belgium/Netherlands): Lidl disclosed a breach at a third-party service provider affecting customers in Germany, Belgium, and the Netherlands. Personal data was exfiltrated. Organizations sharing the same provider should assess exposure and notify their DPO as required under GDPR. No CVE or technical IOCs published.

Active Threats and Campaigns

NEW — Russian FSB Center 16 Router Exploitation Campaign: A joint advisory from CISA, FBI, NSA, UK NCSC, and seven allied agencies confirms that Russian FSB Center 16 actors are actively and opportunistically exploiting poorly configured and vulnerable networking devices — including legacy Cisco IOS (see CVE-2008-4128 above) — to compromise critical infrastructure networks globally. Targeted sectors include energy, government, and telecommunications. The advisory emphasizes that default credentials, unpatched firmware, and exposed management interfaces are the primary entry vectors. European critical infrastructure operators should treat this as an active, ongoing threat. Review the full advisory for detection guidance and IOCs.

NEW — Forg365 PhaaS Targeting Microsoft 365: A new phishing-as-a-service platform called Forg365 combines device code phishing, adversary-in-the-middle (AitM) session theft, AI-generated lures, and antibot evasion to target Microsoft 365 accounts. Distributed via Telegram at $400/month. Post-compromise mailbox operations (rules, forwarding) are automated. Enforce phishing-resistant MFA (FIDO2/hardware tokens); monitor for suspicious device code authentication flows and inbox rule creation.

NEW — Active Scanning for MCP Servers and AI Credentials: SANS ISC reports active internet scanning for exposed Model Context Protocol (MCP) servers and AI assistant API credentials. See also CVE-2026-62327/CVE-2026-59801 (9Router unauthenticated API key disclosure, CVSS 9.3) published this cycle. Organizations deploying AI infrastructure should audit for exposed MCP endpoints and rotate any potentially exposed API keys.

ONGOING — RedHook Android Malware (Wireless ADB persistence): Disable Wireless ADB via MDM; audit for indicators. ONGOING — Ghostcommit prompt injection: Enforce independent secret scanning in CI/CD pipelines. ONGOING — Progress ShareFile: Shutdown directive remains in effect; monitor for CVE publication. ONGOING — WP-SHELLSTORM WordPress mass backdooring: Audit for unauthorized plugins and PHP files. ONGOING — O-UNC-066 vishing / fake Entra passkey enrollment: Enforce phishing-resistant MFA.

Security News and Context

EU/UK sanctions Russian GRU hackers: The EU and UK jointly sanctioned Russian GRU-linked individuals and entities responsible for cyberattacks across Europe, including attacks on German institutions. (Bleeping Computer)

CrashStealer macOS malware: A new macOS infostealer written in native C++ uses a notarized dropper to bypass Gatekeeper, harvesting credentials, keychain data, and crypto wallets while posing as Apple’s crash reporting tool. (Bleeping Computer)

Jscrambler npm supply chain compromise: A malicious version of the Jscrambler npm package containing infostealer malware was downloaded approximately 1,500 times; rotate secrets from affected build environments. (Bleeping Computer)

ModHeader browser extension removed: Google and Microsoft pulled the ModHeader extension (1.6M installs) after a dormant browsing-history collector was found; no confirmed data exfiltration. (The Hacker News)

  1. Apply SAP July 2026 Patch Day updates immediately: prioritize CVE-2026-44747 (NetWeaver ABAP, CVSS 9.9), CVE-2026-27690 (Approuter, CVSS 9.1), and CVE-2026-44761 (Commerce Cloud default OAuth2 credentials).
  2. Patch ServiceNow AI Platform (CVE-2026-6875, CVSS 9.5): apply the relevant patched release; restrict external access pending upgrade.
  3. Harden all network edge devices per the CISA/NCSC Russian FSB advisory: disable HTTP management on Cisco IOS (no ip http server), rotate default credentials, patch firmware, and restrict management interface access to trusted IPs.
  4. Apply JetBrains patches for TeamCity and IntelliJ IDEA (BSI WID-SEC-2026-2288/2285): prioritize internet-facing TeamCity instances.
  5. Patch Netwrix Password Secure (BSI WID-SEC-2026-2296): audit PAM access logs for anomalous activity.
  6. Block device code authentication flows in Microsoft 365 Conditional Access policies to counter Forg365 PhaaS; audit for suspicious inbox rules and OAuth app grants.
  7. Audit AI/MCP infrastructure for exposed endpoints; rotate API keys for any AI provider accounts accessible via 9Router or similar tools.
  8. Audit npm dependencies for the compromised Jscrambler package; rotate secrets from any affected CI/CD environments.
  9. Verify macOS endpoint security: ensure CrashStealer IOCs are in EDR detection rules; validate Gatekeeper and notarization policies.
  10. Continue remediation of previously reported items: CVE-2026-56271 (Flowise), CVE-2026-58596/58281 (Edge), CVE-2026-48939/56291 (Joomla), CVE-2026-55255 (Langflow), CVE-2026-8037 (Kemp LoadMaster), CVE-2026-46817 (Oracle EBS), CVE-2026-48282/48316 (ColdFusion).