SAP Patches Privilege Escalation in ABAP Developer Tools and Multiple High-Severity Flaws

SAP released Security Patch Day updates to fix multiple newly disclosed vulnerabilities across its product portfolio, including two critical and six high-severity issues affecting SAP NetWeaver Application Server ABAP, SAP Manufacturing Integration and Intelligence, ABAP Developer Tools, BusinessObjects Business Intelligence Platform Central Management Server, and the SAP Business AI Platform Approuter node.js package. The vulnerabilities span arbitrary code execution, arbitrary file write, denial of service, tampering, and information disclosure, and SAP urged customers to apply the relevant security bulletins and product updates.

Among the disclosed flaws, CVE-2026-58243 affects SAP ABAP Developer Tools and carries a CVSS 8.8 rating. The vulnerability stems from missing authorization checks (CWE-862) that can let a low-privileged attacker perform unauthorized database operations against SAP NetWeaver AS ABAP over the network. Successful exploitation could expose sensitive data, alter application data, and disrupt legitimate user access. SAP identified affected SAP_BASIS versions as 750, 751, 752, 753, 754, 755, 756, 757, 758, 816, 918, and 920, and recommended patching, tightening database operation permissions, limiting user privileges, and monitoring logs for unauthorized activity.