SAP's monthly release landed alongside Microsoft's. Twenty-eight new security notes, plus a GitHub advisory, with three sitting in critical territory. The worst is CVE-2026-44747 at CVSS 9.9 in NetWeaver Application Server ABAP. Two more follow at 9.1 — CVE-2026-27690 in Approuter and CVE-2026-44761 in Commerce Cloud. If you run any of these near the network edge, they jump the queue ahead of the routine notes.