Loading story…
SAP released security updates for 17 vulnerabilities across its product portfolio, including two critical flaws led by CVE-2024-41730 in SAP BusinessObjects Business Intelligence Platform. The vulnerability carries a CVSS 9.8 rating and can allow a remote, unauthenticated attacker to take full control of an affected system through the REST interface when SSO is enabled. The issue is tracked in the CVE program and was highlighted alongside broad remediation guidance urging customers to apply the latest patches immediately.
SAP also fixed CVE-2024-29415 in SAP Build Apps, a CVSS 9.1 server-side request forgery flaw tied to a Node.js component that improperly distinguishes public and private IP addresses. Additional patched issues across SAP products could enable code execution, cross-site scripting, SSRF, XML injection, privilege escalation, denial of service, unauthorized access to sensitive data, and authentication bypass, underscoring the risk to internet-exposed and enterprise SAP environments.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
SAP released security updates across its product portfolio to fix 17 vulnerabilities, including two rated critical. The fixes included CVE-2024-41730 in SAP BusinessObjects Business Intelligence Platform and CVE-2024-29415 in SAP Build Apps, and defenders were urged to update affected systems immediately.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SAP released multiple security updates addressing critical vulnerabilities across core enterprise products, including **SAP NetWeaver**, **SAP S/4HANA**, **SAP Commerce Cloud**, **SAP Business Warehouse**, **SAP Business Planning and Consolidation**, **SAP Kernel**, **ABAP Platform**, **SAP NetWeaver Application Server Java**, and **SAP Forecasting & Replenishment**. The fixes covered at least 15 vulnerabilities in both the April-to-June advisories, with several flaws rated **critical** and carrying CVSS scores from **9.0 to 9.9**. Reported impacts included **SQL injection**, **remote code execution**, **operating system command execution**, **directory traversal**, **memory corruption**, **sensitive data exposure**, **denial of service**, privilege abuse, and potential full compromise of confidentiality, integrity, and availability. Among the most severe issues, **CVE-2026-27681** affected SAP Business Planning and Consolidation and SAP Business Warehouse, allowing a low-privileged authenticated attacker to upload a file containing SQL commands and execute arbitrary database operations; SAP said a temporary mitigation was to revoke the `S_GUI` authorization object with Activity 60 (Upload) where possible. Additional high-risk flaws included **CVE-2026-34260** and **CVE-2026-34263** in SAP S/4HANA, SAP Commerce Cloud, and SAP Forecasting & Replenishment, each scored **9.6**, as well as critical June issues in NetWeaver-related components that could enable unauthorized access, file-processing abuse, and system compromise. SAP and national defenders urged organizations to apply vendor-specified patches immediately.
Jul 24, 2026
SAP released Security Patch Day updates to fix multiple newly disclosed vulnerabilities across its product portfolio, including **two critical** and **six high-severity** issues affecting SAP NetWeaver Application Server ABAP, SAP Manufacturing Integration and Intelligence, ABAP Developer Tools, BusinessObjects Business Intelligence Platform Central Management Server, and the SAP Business AI Platform Approuter `node.js` package. The vulnerabilities span arbitrary code execution, arbitrary file write, denial of service, tampering, and information disclosure, and SAP urged customers to apply the relevant security bulletins and product updates. Among the disclosed flaws, **`CVE-2026-58243`** affects **SAP ABAP Developer Tools** and carries a **CVSS 8.8** rating. The vulnerability stems from **missing authorization checks** (`CWE-862`) that can let a low-privileged attacker perform unauthorized database operations against **SAP NetWeaver AS ABAP** over the network. Successful exploitation could expose sensitive data, alter application data, and disrupt legitimate user access. SAP identified affected **SAP_BASIS** versions as `750`, `751`, `752`, `753`, `754`, `755`, `756`, `757`, `758`, `816`, `918`, and `920`, and recommended patching, tightening database operation permissions, limiting user privileges, and monitoring logs for unauthorized activity.
Aug 12, 2026
SAP released 15 new security notes to fix vulnerabilities across major product lines, with four critical issues demanding immediate attention in **SAP NetWeaver**, **SAP Commerce Cloud**, and **SAP Data Hub**. The most severe flaw, **`CVE-2026-44748`** (CVSS 9.9), is an XML signature wrapping weakness in SAML authentication for **SAP NetWeaver AS ABAP** and **ABAP Platform** that could let an authenticated attacker tamper with signed identity data, leading to unauthorized access and privilege escalation. SAP also patched **`CVE-2026-27671`** (CVSS 9.8), an unauthenticated memory corruption bug in the ABAP kernel’s RFC handling that can be triggered with crafted RFC requests. Other critical fixes include **`CVE-2026-40128`**, a directory traversal flaw in **SAP NetWeaver AS Java** Web Container, and **`CVE-2026-22732`**, a Spring Security issue affecting **SAP Commerce Cloud** and **SAP Data Hub** that could expose clients to connection hijacking. Additional patches addressed weaknesses in **SAP S/4HANA**, **ODP Data Replication APIs**, **SAP Wily Introscope Enterprise Manager**, **SAP MDG**, **SAP Business Objects**, and **SAP Fiori launchpad**, including SQL injection, reflected XSS, and Apache Log4j exposure. Canada’s Cyber Centre urged administrators to review SAP advisories, apply updates, and follow recommended mitigations across affected ABAP and Java environments.
Jun 29, 2026