Loading story…
SAP’s February 2026 Security Patch Day shipped 26 new SAP Security Notes (plus one updated note) and urged customers to prioritize patching across core SAP workloads. The most severe issue is CVE-2026-0488 (CVSS 9.9), a code-injection vulnerability in the Scripting Editor of SAP CRM and SAP S/4HANA (SAP Note 3697099), which can be exploited by an authenticated, low-privilege user to execute arbitrary code/unauthorized functionality with broad impact across the environment.
The bulletin also addressed additional critical and high-severity risks, including CVE-2026-0509 (CVSS 9.6; SAP Note 3674774), a missing authorization check in SAP NetWeaver Application Server ABAP / ABAP Platform that can allow low-privilege users to perform unauthorized actions (including background RFC activity). Other highlighted items include CVE-2026-23687 (XML Signature Wrapping) affecting trust decisions in XML-based flows, and CVE-2026-23689 in SAP Supply Chain Management, an uncontrolled resource consumption issue that can be abused to cause denial of service by exhausting system resources via repeated calls with oversized parameters.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
On 2026-02-10, the Canadian Centre for Cyber Security published advisory AV26-107 summarizing SAP's February 2026 Security Patch Day. The agency highlighted affected SAP products, explicitly referenced CVE-2026-0488 and CVE-2026-0509, and urged administrators to review SAP advisories and deploy mitigations and updates.
The same February 2026 patch cycle also fixed other notable issues, including CVE-2026-23687, an XML Signature Wrapping flaw in SAP NetWeaver trust verification, and CVE-2026-23689, a denial-of-service issue in SAP Supply Chain Management. Additional patches covered DoS, race condition, open redirect, XSS, insecure deserialization, information disclosure, and authorization weaknesses in products such as SAP BusinessObjects, SAP Commerce Cloud, SAP Document Management System, and SAP Fiori apps.
On 2026-02-10, SAP also remediated CVE-2026-0509, a critical missing authorization check in SAP NetWeaver Application Server ABAP / ABAP Platform rated CVSS 9.6. The issue could let low-privileged authenticated users bypass controls and perform unauthorized background RFC actions, affecting integrity and availability.
As part of the 2026-02-10 patch release, SAP fixed CVE-2026-0488, a critical code injection flaw in the Scripting Editor of SAP CRM and SAP S/4HANA rated CVSS 9.9. The vulnerability could allow an authenticated low-privilege attacker to execute arbitrary SQL or code and potentially fully compromise the database.
On 2026-02-10, SAP published its February 2026 Security Patch Day updates, releasing 26 new security notes and one update affecting multiple products including SAP CRM, SAP S/4HANA, SAP NetWeaver, SAP Supply Chain Management, SAP BusinessObjects, and SAP Commerce Cloud. The release included fixes for critical, high, and medium-severity vulnerabilities and urged customers to apply updates promptly.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
3 references tracked. Mallory keeps watching after this page renders.
cyber.gc.ca
Open sourcecybersecuritynews.com
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SAP’s March 2026 Patch Day delivered **15 security notes** addressing vulnerabilities across its portfolio, including two **critical** issues that could lead to **remote code execution** and full system compromise. The most severe item highlighted is **CVE-2019-17571** (CVSS **9.8**) in *SAP Quotation Management Insurance* (`FS-QUO 800`), tied to an outdated **Apache Log4j SocketServer** component that accepts and deserializes serialized log events without authentication, enabling unauthenticated attackers to execute arbitrary code; reporting noted this is the first SAP patch specifically issued for `FS-QUO 800` despite the CVE dating to 2019. SAP also patched **CVE-2026-27685** (CVSS **9.1**) affecting *SAP NetWeaver Enterprise Portal Administration* (`EP-RUNTIME 7.50`), described as an **insecure deserialization** condition where a **privileged user** can upload malicious/untrusted content that, when deserialized by the server, can significantly impact confidentiality, integrity, and availability—effectively enabling host-level control; this is addressed in **SAP Security Note `3714585`**. Additional fixes included a high-severity **denial-of-service** issue (**CVE-2026-27689**, CVSS **7.7**) in *SAP Supply Chain Management* impacting multiple `SCMAPO`, `S4CORE`, `S4COREOP`, and `SCM` versions, exploitable by an authenticated low-privileged attacker to disrupt availability over the network.
Jun 29, 2026
SAP released 15 new security notes to fix vulnerabilities across major product lines, with four critical issues demanding immediate attention in **SAP NetWeaver**, **SAP Commerce Cloud**, and **SAP Data Hub**. The most severe flaw, **`CVE-2026-44748`** (CVSS 9.9), is an XML signature wrapping weakness in SAML authentication for **SAP NetWeaver AS ABAP** and **ABAP Platform** that could let an authenticated attacker tamper with signed identity data, leading to unauthorized access and privilege escalation. SAP also patched **`CVE-2026-27671`** (CVSS 9.8), an unauthenticated memory corruption bug in the ABAP kernel’s RFC handling that can be triggered with crafted RFC requests. Other critical fixes include **`CVE-2026-40128`**, a directory traversal flaw in **SAP NetWeaver AS Java** Web Container, and **`CVE-2026-22732`**, a Spring Security issue affecting **SAP Commerce Cloud** and **SAP Data Hub** that could expose clients to connection hijacking. Additional patches addressed weaknesses in **SAP S/4HANA**, **ODP Data Replication APIs**, **SAP Wily Introscope Enterprise Manager**, **SAP MDG**, **SAP Business Objects**, and **SAP Fiori launchpad**, including SQL injection, reflected XSS, and Apache Log4j exposure. Canada’s Cyber Centre urged administrators to review SAP advisories, apply updates, and follow recommended mitigations across affected ABAP and Java environments.
Jun 29, 2026
SAP released multiple security updates addressing critical vulnerabilities across core enterprise products, including **SAP NetWeaver**, **SAP S/4HANA**, **SAP Commerce Cloud**, **SAP Business Warehouse**, **SAP Business Planning and Consolidation**, **SAP Kernel**, **ABAP Platform**, **SAP NetWeaver Application Server Java**, and **SAP Forecasting & Replenishment**. The fixes covered at least 15 vulnerabilities in both the April-to-June advisories, with several flaws rated **critical** and carrying CVSS scores from **9.0 to 9.9**. Reported impacts included **SQL injection**, **remote code execution**, **operating system command execution**, **directory traversal**, **memory corruption**, **sensitive data exposure**, **denial of service**, privilege abuse, and potential full compromise of confidentiality, integrity, and availability. Among the most severe issues, **CVE-2026-27681** affected SAP Business Planning and Consolidation and SAP Business Warehouse, allowing a low-privileged authenticated attacker to upload a file containing SQL commands and execute arbitrary database operations; SAP said a temporary mitigation was to revoke the `S_GUI` authorization object with Activity 60 (Upload) where possible. Additional high-risk flaws included **CVE-2026-34260** and **CVE-2026-34263** in SAP S/4HANA, SAP Commerce Cloud, and SAP Forecasting & Replenishment, each scored **9.6**, as well as critical June issues in NetWeaver-related components that could enable unauthorized access, file-processing abuse, and system compromise. SAP and national defenders urged organizations to apply vendor-specified patches immediately.
Jul 24, 2026