SAP patches critical CVE-2026-44747 in NetWeaver ABAP

What changed

Finding 01 reports that SAP released updates addressing CVE-2026-44747, a Critical, CVSS 9.9 out-of-bounds write in SAP NetWeaver Application Server ABAP. Finding 02 identifies CVE-2026-54076 as a High-severity authorisation issue in ArcadeDB and describes it as an incomplete fix for Critical CVE-2026-44221.

Finding 03 identifies Critical CVE-2026-55579 in Pheditor, where a hard-coded default password of 'admin' without a forced change can enable full application compromise. Finding 04 reports security updates for Critical CVE-2026-53412, which affects Zoom Workplace for Windows and Zoom Workplace VDI Client for Windows and could facilitate account takeover.

Finding 05 identifies High-severity CVE-2026-24157 in NVIDIA NeMo Framework, while Findings 06 and 07 identify distinct High-severity WatchGuard FireWare OS issues: CVE-2026-13084 can produce denial of service on VPN systems using IKEv2, and CVE-2026-8247 can permit unauthenticated, network-adjacent code execution.

Finding 08 identifies High-severity CVE-2026-8108 as a local denial-of-service risk in Fuji Electric Tellus. Finding 09 identifies High-severity CVE-2026-8921 as a local privilege-escalation risk in ASUS Business Manager, and Finding 10 identifies High-severity CVE-2026-48344 as a local privilege-escalation risk in Adobe Creative Cloud Desktop Application.

Finding 11 retains High-severity CVE-2026-59117 with an integer-overflow or wraparound classification. Finding 12 identifies High-severity CVE-2026-52833 in Nuclio as build-time code execution arising from injected repository attributes. Finding 13 identifies High-severity CVE-2026-55578 in Pheditor as command injection through incomplete terminal-command sanitisation. Finding 14 retains High-severity CVE-2026-58598 with a race-condition classification. Finding 15 identifies Medium-severity CVE-2026-35188 in OpenSSL, where malformed OCSP responses can lead to a double free.

Why it matters

The Critical findings require separate treatment rather than a shared remediation assumption. Finding 01 concerns authenticated access to SAP NetWeaver ABAP; Finding 02 concerns authorisation boundaries in ArcadeDB; Finding 03 concerns an unchanged default credential in Pheditor; and Finding 04 concerns an unauthenticated network-access path affecting specified Zoom clients.

The High and Medium findings also have materially different prerequisites. Findings 08, 09 and 10 require existing low-privileged local code execution; Finding 05 requires user interaction; Finding 06 is limited to FireWare OS systems using VPN with IKEv2; and Finding 07 is network-adjacent and does not require authentication.

• Recommended actions
• SAP Basis/application owner: For Finding 01, inventory SAP NetWeaver Application Server ABAP exposure to CVE-2026-44747 and apply the SAP July 2026 security update, prioritising systems on which authenticated users can reach the affected application.
• ArcadeDB owner: For Finding 02, test whether read-only users can mutate database schema, verify remediation for CVE-2026-54076 against the linked GitHub advisory, and confirm that the earlier CVE-2026-44221 fix is present.
• Pheditor owner: For Finding 03, identify Pheditor deployments affected by CVE-2026-55579, check for the default 'admin' password, replace unchanged credentials immediately and verify remediation guidance in the linked GitHub advisory.
• Endpoint and collaboration owner: For Finding 04, inventory Zoom Workplace for Windows and Zoom Workplace VDI Client for Windows, then update affected installations for CVE-2026-53412 using the applicable release branch.
• Machine-learning platform owner: For Finding 05, update NVIDIA NeMo Framework for CVE-2026-24157 and restrict the opening of untrusted checkpoint files, malicious files and pages pending completion.
• Network-security owner: For Finding 06, identify WatchGuard FireWare OS systems using VPN with IKEv2 and apply the update referenced by the ZDI advisory for CVE-2026-13084.
• Network-security owner: For Finding 07, identify network-adjacent access to WatchGuard FireWare OS, prioritise the update for CVE-2026-8247 and reduce untrusted adjacency until remediation is complete.
• Operational-technology owner: For Finding 08, inventory Fuji Electric Tellus installations, apply the update referenced by the ZDI advisory for CVE-2026-8108 and limit low-privileged local code execution.
• Endpoint owner: For Finding 09, update ASUS Business Manager for CVE-2026-8921 and investigate endpoints where untrusted users can already execute low-privileged local code.
• Creative-software owner: For Finding 10, apply Adobe's update for CVE-2026-48344 and review affected endpoints for unauthorised changes involving the AGSService or execution in the SYSTEM context.
• Windows platform owner: For Finding 11, use Microsoft's linked advisory to establish the affected inventory and applicable update for CVE-2026-59117; do not infer affected versions from the available evidence.
• DevSecOps owner: For Finding 12, identify Nuclio build configurations that accept runtimeAttributes.repositories, follow the linked GitHub advisory for CVE-2026-52833 and restrict untrusted control of those attributes.
• Pheditor owner: For Finding 13, follow the linked GitHub advisory for CVE-2026-55578 and restrict access to the terminal feature until command sanitisation against pipe operators, backticks and newline injection has been remediated.
• Windows platform owner: For Finding 14, use Microsoft's linked advisory to determine affected systems and the applicable response for CVE-2026-58598; the available evidence does not establish affected versions or a fixed release.
• Cryptography and platform owner: For Finding 15, identify OpenSSL clients that process OCSP responses, apply the available update for CVE-2026-35188 and verify inclusion of fix commit aae016bfd52fcad2bc9657c2c782cfdf73b1ed5f.

Evidence limits

No finding contains confirmed exploitation evidence. Finding 01 reports an SAP update but does not identify a fixed version in the available technical evidence. Findings 03, 04, 12 and 13 likewise do not provide a captured fixed version or commit.

Several source scores differ from the assessed severity evidence. For Finding 06, ZDI assigns CVSS 5.9 while the assessed CVSS 4.0 value is 8.7; Finding 07 has ZDI 7.5 versus assessed 7.7; Finding 08 has ZDI 5.5 versus assessed 7.8; Finding 09 has ZDI 7.8 versus assessed 8.5; and Finding 15 has ZDI 7.5 versus assessed 5.0. These conflicts are not resolved here, and the narrower assessed severity labels used in this brief remain High for Findings 06 through 09 and Medium for Finding 15.

The captured Microsoft pages for Findings 11 and 14 do not expose product, affected-version, impact or remediation detail without client-side rendering. Their public descriptions are therefore limited to the per-CVE severity and weakness evidence for CVE-2026-59117 and CVE-2026-58598.