Federal Agencies Rush to Patch Critical SAP NetWeaver Flaw Amid Active Exploitation

Federal Agencies Rush to Patch Critical SAP NetWeaver Flaw Amid Active Exploitation

The Cybersecurity and Infrastructure Security Agency issued an emergency directive Thursday requiring federal civilian agencies to patch a critical SAP NetWeaver vulnerability within 72 hours after confirming active exploitation in the wild.

The flaw, tracked as CVE-2026-38471 with a CVSS score of 9.8, affects SAP NetWeaver Application Server Java versions 7.40 through 7.50. The vulnerability allows unauthenticated attackers to bypass authentication mechanisms and execute arbitrary code on vulnerable systems through specially crafted HTTP requests to the Universal Worklist service.

Security teams have observed exploitation attempts originating from infrastructure previously associated with APT41, though attribution remains preliminary. The attacks specifically target organizations in defense contracting, energy, and telecommunications sectors—industries where SAP deployments manage critical business operations and often connect to sensitive data repositories.

What makes this vulnerability particularly dangerous is its position in the attack chain. Successful exploitation provides attackers immediate administrative access to SAP systems without requiring credentials, effectively handing over keys to enterprise resource planning data, financial records, and supply chain information.

SAP released patches on August 15th as part of its monthly security updates, but adoption has been slower than typical due to the complexity of SAP environments and concerns about business disruption. Many organizations run custom SAP configurations that require extensive testing before applying patches, creating a dangerous window of exposure.

The CISA directive mandates that agencies not only patch vulnerable systems but also audit their SAP environments for indicators of compromise dating back to August 1st. Specific IOCs include unusual Universal Worklist service calls, unexpected administrative account creation, and abnormal database queries occurring outside maintenance windows.

For organizations outside federal mandates, the message is clear: SAP systems have become high-value targets, and the window between disclosure and active exploitation continues to shrink. Security teams should prioritize this patch even if it means scheduling emergency maintenance windows over the holiday weekend.