SAP published new security information on Security Patch Day in August 2026. It covers 28 security notes, two updates to earlier notes, and also a GitHub advisory. In this series are multiple vulnerabilities with particularly high severity, including issues that can lead to code execution and unauthorized access.
In this article, we summarize the key points around SAP security updates, so you can determine which systems should be patched first.
Critical SAP security updates: what’s most urgent?
Of the publications SAP announced, four notes address what are considered critical vulnerabilities. This includes one issue with a maximum score: CVE-2026-58231 (CVSS 10/10). This vulnerability affects SAP Commerce Cloud, specifically the Data Hub Adapter.
According to SAP, this is an improper authorization problem. That means an attacker may be able to bypass authentication. If exploitation succeeds, it can further lead to code execution and access to internal components that are normally not reachable. The impact affects confidentiality, integrity, and availability of the application.
Code injection in Manufacturing Integration and Intelligence
In addition to the authorization bug, SAP also addresses two critical code injection vulnerabilities in Manufacturing Integration and Intelligence. These are:
- CVE-2026-44772 (CVSS 9.9/10)
- CVE-2026-44758 (CVSS 9.1/10)
The core issue is that vulnerable servlets can be abused by an attacker using specially crafted input. As a result, arbitrary command execution may occur on the host where the component runs, potentially causing full infrastructure compromise.
Although the two flaws look similar, according to security firm Onapsis there are differences in exploitation conditions: in one variant, higher privileges are required to make abuse possible.
Memory corruption in Application Server ABAP
The fourth critical defect is described by SAP as a memory corruption issue in Application Server ABAP for NetWeaver and ABAP Platform. The vulnerability is CVE-2026-34265 (CVSS 9.8/10).
SAP links the flaw to logical errors in DIAG protocol parsing. Important for risk assessment is that the vulnerability could be exploited without authentication. This would allow an attacker to:
- leak sensitive information
- or cause the system to crash
Here too, the potential impact targets the confidentiality, integrity, and availability of the application environment.
Other high-severity issues: privilege escalation and more
Alongside the four critical notes, SAP also releases eight additional notes covering high-severity vulnerabilities. These relate to a broader range of components, including ABAP Developer Tools, Commerce Cloud, Change and Transport System Attach Tool, BusinessObjects, Manufacturing Integration and Intelligence, and Business AI Platform (especially Approuter).
According to SAP’s description, the first seven high-severity issues deal with various attack techniques, such as:
- privilege escalation
- buffer overflow
- remote code execution (RCE)
- credentials disclosure
- directory traversal
- missing authorization checks
In addition, the note about Approuter includes a specific resolution: it addresses a total of 11 security defects.
Updates for previously published issues
SAP also states that two updates were released for previously published security notes. In any case, an earlier critical security note was already updated to further improve a memory corruption bug in NetWeaver Application Server ABAP.
The update includes additional information compared to the original publication. This matters for teams that were already patching: the “latest version” of the note may contain new guidance or context for exploitation conditions and approach.
Medium- and low-severity: still include them in your planning
Besides the high- and critical categories, SAP also publishes security issues with medium- and low-severity. SAP indicates that the announcement contains no indication of exploitation in the wild for these flaws.
That doesn’t mean you can ignore them. In practice, the combination of accumulation and environment coupling can cause even less severe bugs to contribute to a chain of misuse. Include these notes in your monthly or quarterly routines.
Practical approach: how to handle SAP security updates
To limit the impact of a patch cycle while reducing risks quickly, you can follow this order.
1) Inventory which SAP components you use
Start by mapping which systems and installations in your environment include, for example, SAP Commerce Cloud, Manufacturing Integration and Intelligence, and Application Server ABAP. The more accurate your component inventory, the more targeted your patching can be.
2) Prioritize by severity and exploitation path
Give priority to issues with the highest CVSS scores and/or with an exploitable path that requires fewer layers of protection. In this round, CVE-2026-58231 (auth bypass), the code injection flaws (servlets and RCE), and CVE-2026-34265 (memory corruption without authentication) clearly stand out.
3) Pair patching with detection and hardening
Although patching is the core solution, you can also work in parallel on measures that reduce your attack paths: access control, segmentation, and logging for component-specific activities. This reduces the chance that a vulnerability can be exploited temporarily.
4) Communicate impact to stakeholders
For enterprise environments, change management is essential. Define in advance which teams are involved in releases, test windows, and rollback scenarios, so the updates don’t get stuck.
Related developments: why patching pace matters
This SAP cycle fits into a broader trend in which both code execution and memory corruption regularly take center stage. If you want to compare how other vendors or ecosystems handle similar risks, there are also articles on this site that may help you with your patching and threat model:
