July 2026 SAP Patch Day: CVE-2026-44768 in CRM WebClient UI Demands Immediate Action

Dr. Sarah Chen breaks down what you need to know

After 16 years of SAP patch cycles, I’ve learned that the notes which look like yesterday’s problem are often the ones that bite you. July 2026 gives us another example. Among the twenty new and updated SAP Security Notes this month, CVE-2026-44768 stands out because it hits a component many teams have pushed to the back of the maintenance queue: SAP CRM WebClient UI. If your landscape still runs CRM, this is not a note to skim and archive.

The Real Story

SAP’s July 2026 monthly patch release includes roughly twenty Security Notes covering a mix of new issues and updates to previous fixes. Most will follow the usual severity distribution: medium-priority items in less-exposed modules, a few high-priority notes requiring manual steps, and the typical ABAP or Java kernel corrections. But CVE-2026-44768 should trigger an immediate review because it affects the WebClient UI layer of SAP CRM — a component that frequently sits at the edge of the network and handles sensitive customer and sales data.

The vulnerability itself is described as a missing authorization check in the CRM WebClient UI runtime. In practical terms, that means a low-privileged user or, in some configurations, an unauthenticated caller could access UI functions they should never see. The usual attack vector is a crafted HTTP request to a BSP application or handler class that processes input without verifying the user’s authorization for the underlying business object. If your CRM system is reachable from a browser, an attacker with only network access might trigger a read, update, or navigation action that bypasses standard role checks.

What makes this especially risky is the age of the affected component. SAP CRM 7.0 is still present in many organizations, often running on older NetWeaver stacks and maintained by teams that have shifted most attention to S/4HANA. WebClient UI customizations and BSP extensions accumulate over years. Patch cycles for CRM sometimes require manual application of notes rather than a simple Support Package stack. That combination — legacy code, manual patching, low visibility — is exactly where security gaps persist.

What This Means for You

For Basis and security administrators, the first job is to determine whether CVE-2026-44768 applies to your landscape. Check the SAP Security Note for affected software component versions and support package levels. If you run SAP CRM WebClient UI, treat this as a high-priority patch. Do not wait for the next change window if the system is accessible from the internet or from a large internal user base.

For CRM functional consultants and developers, the patch is only part of the story. The missing authorization check may exist not only in standard SAP code but also in custom BSP extensions or copied handler classes. I’ve seen too many projects where developers clone a standard UI component, modify the backend logic, and forget to add the same AUTHORITY-CHECK that the standard code eventually received. The patch fixes SAP’s piece. Your custom code may still be open.

Here is a basic example of what a proper authorization check looks like in a BSP controller or handler class:

AUTHORITY-CHECK OBJECT 'CRM_UIU'
  ID 'ACTVT' FIELD '03'.   " Display activity
IF sy-subrc <> 0.
  MESSAGE e001(zcrm_ui) WITH 'No authorization for CRM UI display'.
  RETURN.
ENDIF.

The exact authorization object for CVE-2026-44768 may differ, but the pattern is what matters: every UI action that lands on a business object must verify the user’s activity before reading or changing data. A patch alone will not catch

References

• SAP Security Notes: July 2026 Patch Day
• SAP Security Notes & News
• SAP Basis Administration Community

References

• SAP Basis Administration Community
• SAP Security Notes: July 2026 Patch Day
• SAP Security Notes & News