Loading story…
SAP released multiple security updates addressing critical vulnerabilities across core enterprise products, including SAP NetWeaver, SAP S/4HANA, SAP Commerce Cloud, SAP Business Warehouse, SAP Business Planning and Consolidation, SAP Kernel, ABAP Platform, SAP NetWeaver Application Server Java, and SAP Forecasting & Replenishment. The fixes covered at least 15 vulnerabilities in both the April-to-June advisories, with several flaws rated critical and carrying CVSS scores from 9.0 to 9.9. Reported impacts included SQL injection, remote code execution, operating system command execution, directory traversal, memory corruption, sensitive data exposure, denial of service, privilege abuse, and potential full compromise of confidentiality, integrity, and availability.
Among the most severe issues, CVE-2026-27681 affected SAP Business Planning and Consolidation and SAP Business Warehouse, allowing a low-privileged authenticated attacker to upload a file containing SQL commands and execute arbitrary database operations; SAP said a temporary mitigation was to revoke the S_GUI authorization object with Activity 60 (Upload) where possible. Additional high-risk flaws included CVE-2026-34260 and CVE-2026-34263 in SAP S/4HANA, SAP Commerce Cloud, and SAP Forecasting & Replenishment, each scored 9.6, as well as critical June issues in NetWeaver-related components that could enable unauthorized access, file-processing abuse, and system compromise. SAP and national defenders urged organizations to apply vendor-specified patches immediately.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
SAP released June 2026 security updates remediating 15 vulnerabilities, including four critical issues affecting SAP NetWeaver AS ABAP, ABAP Platform, SAP Kernel, and SAP NetWeaver Application Server Java. The flaws could enable unauthorized data access, privilege abuse, directory traversal, file processing abuse, memory corruption, and full compromise of confidentiality, integrity, and availability.
SAP published its June 2026 Security Notes, as reflected in the vendor's Security Notes & News reference. This marks the vendor release point for that month's security advisories.
SAP released security updates in May 2026 addressing 15 vulnerabilities across multiple products, including critical flaws affecting SAP S/4HANA, SAP Commerce Cloud, and SAP Forecasting & Replenishment. The patched issues included risks such as SQL injection, remote code execution, OS command execution, sensitive data exposure, and denial of service.
SAP released April 2026 security updates that fixed CVE-2026-27681, a critical SQL injection vulnerability affecting SAP Business Planning and Consolidation and SAP Business Warehouse. The flaw could let a low-privileged authenticated attacker execute arbitrary SQL commands and alter or delete database contents.
SAP released security updates across its product portfolio to fix 20 vulnerabilities, including three critical flaws. The critical issues affected SAP S/4HANA, SAP Landscape Transformation, and SAP Financial Consolidation, with impacts including remote code execution, authentication bypass, and potential full system compromise.
SAP released its July 2024 security patch bundle addressing 16 vulnerabilities across multiple products. The update included two high-severity flaws: CVE-2024-39592 in SAP PDCE and CVE-2024-39597 in SAP Commerce, and SAP advised immediate patching with temporary mitigations for both issues.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
8 references tracked. Mallory keeps watching after this page renders.
csirt.sk
Open sourcesupport.sap.com
Open sourcecsirt.sk
Open sourcecsirt.sk
Open sourceonapsis.com
Open sourcecsirt.sk
Open sourcecsirt.sk
Open sourcecve.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SAP released 15 new security notes to fix vulnerabilities across major product lines, with four critical issues demanding immediate attention in **SAP NetWeaver**, **SAP Commerce Cloud**, and **SAP Data Hub**. The most severe flaw, **`CVE-2026-44748`** (CVSS 9.9), is an XML signature wrapping weakness in SAML authentication for **SAP NetWeaver AS ABAP** and **ABAP Platform** that could let an authenticated attacker tamper with signed identity data, leading to unauthorized access and privilege escalation. SAP also patched **`CVE-2026-27671`** (CVSS 9.8), an unauthenticated memory corruption bug in the ABAP kernel’s RFC handling that can be triggered with crafted RFC requests. Other critical fixes include **`CVE-2026-40128`**, a directory traversal flaw in **SAP NetWeaver AS Java** Web Container, and **`CVE-2026-22732`**, a Spring Security issue affecting **SAP Commerce Cloud** and **SAP Data Hub** that could expose clients to connection hijacking. Additional patches addressed weaknesses in **SAP S/4HANA**, **ODP Data Replication APIs**, **SAP Wily Introscope Enterprise Manager**, **SAP MDG**, **SAP Business Objects**, and **SAP Fiori launchpad**, including SQL injection, reflected XSS, and Apache Log4j exposure. Canada’s Cyber Centre urged administrators to review SAP advisories, apply updates, and follow recommended mitigations across affected ABAP and Java environments.
Jun 29, 2026
SAP released its June Security Patch Day updates to fix multiple vulnerabilities across products including **SAP NetWeaver AS ABAP**, **ABAP Platform**, **SAP NetWeaver Application Server Java**, **SAP Commerce Cloud**, **SAP Data Hub**, **SAP S/4HANA**, **SAP Business Objects Business Intelligence Platform**, and **SAP Fiori launchpad**. The issues could allow cross-site scripting, denial of service, email spoofing, sensitive information disclosure, privilege escalation, data manipulation, arbitrary code execution, and unauthorized access. The most severe flaws include **`CVE-2026-44748`**, an XML Signature Wrapping weakness in SAML authentication affecting SAP NetWeaver AS ABAP and ABAP Platform with a **CVSS 9.9**, and **`CVE-2026-40128`**, a directory traversal vulnerability in the SAP NetWeaver Application Server Java Web Container rated **CVSS 9.0**. EG-FinCIRT said organizations should apply the patches as soon as testing is complete to reduce exposure across affected SAP environments.
Jul 12, 2026
SAP has released security updates addressing 13 newly identified vulnerabilities across its product suite, with particular focus on a maximum-severity flaw in SAP NetWeaver AS Java. The most critical vulnerability, tracked as CVE-2025-42944 and assigned a CVSS score of 10.0, is an insecure deserialization issue that allows unauthenticated attackers to execute arbitrary operating system commands. This flaw can be exploited via the RMI-P4 module by submitting a malicious payload to an open port, potentially compromising the confidentiality, integrity, and availability of affected systems. SAP initially addressed this vulnerability in a previous update, but the latest patch introduces additional hardening measures, including a JVM-wide filter (jdk.serialFilter) to block the deserialization of dangerous classes. The list of classes and packages to be filtered was developed in collaboration with the Onapsis Research Labs and is divided into mandatory and optional sections to maximize protection. In addition to CVE-2025-42944, SAP has patched a directory traversal vulnerability in SAP Print Service (CVE-2025-42937, CVSS 9.8), which could allow unauthenticated attackers to overwrite system files by exploiting insufficient path validation. Another critical issue, CVE-2025-42910 (CVSS 9.0), affects SAP Supplier Relationship Management and involves unrestricted file upload, enabling authenticated attackers to upload arbitrary files, including potentially malicious executables. These vulnerabilities collectively pose significant risks to enterprise environments running SAP solutions, as successful exploitation could lead to system compromise, data loss, or service disruption. SAP has stated that there is currently no evidence of these vulnerabilities being exploited in the wild. Security experts and SAP have emphasized the importance of promptly applying the latest patches to mitigate the risk of exploitation. The additional hardening for the deserialization flaw is particularly notable, as it provides a more robust defense against a class of attacks that have historically been difficult to fully remediate. Organizations are advised to review their SAP deployments, ensure all relevant updates are applied, and follow SAP’s guidance on blocking risky deserialization classes. The disclosure and remediation of these vulnerabilities highlight the ongoing challenges in securing complex enterprise software platforms. SAP’s collaboration with security researchers and the implementation of layered defenses demonstrate a proactive approach to addressing critical security issues. Enterprises relying on SAP NetWeaver and related products should prioritize these updates as part of their regular patch management processes. Failure to address these vulnerabilities could leave systems exposed to remote attacks that require no authentication, significantly increasing the risk profile for affected organizations. The security community continues to monitor for any signs of exploitation and urges vigilance in maintaining up-to-date SAP environments.
Jun 29, 2026