SAP Security Notes & News (Security Patch Day)
sap-security-notes · A · active
https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html
Added 2026-09-29: SAP's monthly Security Patch Day summary, first-party for SAP NetWeaver / S/4HANA flaws (SAP runs finance and HR across federal and cantonal administrations). RECIPE: `extract https://support.sap.com/en/my-support/knowledge-base/security-notes-news.html` reads the page without the reader (dated 2026-09-08 Patch Day at probe); the note bodies themselves are login-gated, so corroborate details from Onapsis / SecurityBridge write-ups. (2026-09-29 operator-directed setup review) | 2026-10-21 (2026-10-21T0256Z-intel, S1): the monthly Patch Day page reads with `extract https://support.sap.com/en/my-support/knowledge-base/security-notes-news/<month>-<year>.html` (verified for october-2026: the full table of notes with CVE ids, priority and CVSS); the base page returns no note list.
Cited in 5 entries
Citation cadence
Citation days per ISO week (27 weeks of coverage span, total 5).
- CVE-2026-120017, CVE-2026-89126, CVE-2026-76964 and CVE-2026-89103, SAP NetWeaver AS ABAP, Web Dispatcher and Gateway: four unauthenticated network flaws rated CVSS 10.0 and fixed on SAP's November 2026 Patch Day; Onapsis, which found three of them, says a working exploit exists and has seen no attacks2026-11-10
- SAP Commerce Cloud CVE-2026-58231: an unauthenticated request to a vulnerable Data Hub Adapter endpoint reaches arbitrary code execution (CVSS 10.0), and the fix needs a rebuild and redeploy2026-08-12
- SAP July 2026 Security Patch Day: three CVSS ≥9.1 flaws in NetWeaver AS ABAP, Approuter and Commerce Cloud, two reachable without authentication2026-07-14
- CVE-2026-44748, SAP June Patch Day: SAML XML Signature Wrapping in NetWeaver AS ABAP (CVSS 9.9) plus an unauth RFC kernel memory-corruption (CVSS 9.8)2026-06-10
- CVE-2026-34263 and CVE-2026-34260: SAP Commerce Cloud unauthenticated code injection and S/4HANA Enterprise Search SQL injection (May 2026 Patch Day)2026-05-13