SAP S/4HANA
43 notes since January 2023.
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
| Patch Day | Note | Title | Priority (derived from CVSS, not SAP’s priority) | CVSS |
|---|---|---|---|---|
| October 2026 | 3805589 | Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules) | Critical | 9.9 |
| October 2026 | 3799621 | Missing Authorization Check in SAP S/4HANA (Linear Asset Management RAP Business Object) | Medium | 4.7 |
| September 2026 | 3756450 | SQL Injection vulnerability in SAP S/4HANA (Intercompany Matching and Reconciliation) | Medium | 6.5 |
| September 2026 | 3365311 | Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management) | Medium | 4.6 |
| September 2026 | 3657599 | Missing Authorization check in SAP S/4HANA (Manage Bank Chains app) | Medium | 4.3 |
| September 2026 | 3365276 | Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management) | Low | 3.5 |
| September 2026 | 3371336 | Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management) | Low | 3.5 |
| August 2026 | 3669608 | Missing Authorization check in SAP S/4 HANA (Reprocess Bank Statement Items) | Medium | 4.3 |
| July 2026 | 3515598 | Missing Authorization check in SAP S/4HANA (Draft operation) | Medium | 4.3 |
| July 2026 | 3713902 | Missing Authorization check in SAP S/4 HANA (Create Single Payment) | Medium | 4.3 |
| June 2026 | 3751691 | SQL Injection vulnerability in SAP S/4HANA | Medium | 6.5 |
| May 2026 | 3724838 | SQL injection vulnerability in SAP S/4HANA (SAP Enterprise Search for ABAP) | Critical | 9.6 |
| April 2026 | 3703813 | Missing Authorization Check in SAP S/4HANA (Private Cloud and On-Premise) | Medium | 4.9 |
| February 2026 | 3646297 | Information Disclosure vulnerability in S/4HANA (Manage Payment Media) | Medium | 4.3 |
| January 2026 | 3694242 | Code Injection vulnerability in SAP S/4HANA (Private Cloud and On-Premise) | Critical | 9.1 |
| October 2025 | 3625683 | Missing Authorization Check in SAP S/4HANA (Manage Processing Rules - For Bank Statements) | Medium | 4.3 |
| September 2025 | 3635475 | Missing input validation vulnerability in SAP S/4HANA (Private Cloud or On-Premise) | High | 8.1 |
| August 2025 | 3627998 | Code Injection vulnerability in SAP S/4HANA (Private Cloud or On-Premise) | Critical | 9.9 |
| August 2025 | 3614804 | Directory Traversal vulnerability in SAP S/4HANA (Bank Communication Management) | Medium | 6.9 |
| August 2025 | 3616863 | CRLF Injection vulnerability in SAP S/4HANA (Supplier invoice) | Medium | 4.3 |
| June 2025 | 3580384 | Missing Authorization Check in SAP S/4HANA (Enterprise Event Enablement) | Medium | 6.7 |
| June 2025 | 3441087 | Missing Authorization check in SAP S/4HANA (Manage Central Purchase Contract application) | Medium | 5.4 |
| June 2025 | 3596850 | Missing Authorization Check in SAP S/4HANA (Manage Processing Rules - For Bank Statement) | Medium | 4.3 |
| June 2025 | 3608058 | Missing Authorization check in SAP S/4HANA (Bank Account Application) | Medium | 4.3 |
| May 2025 | 3596033 | Information Disclosure vulnerability in SAP S/4HANA (Private Cloud & On-Premise) | Medium | 6.4 |
| May 2025 | 3227940 | Missing Authorization check in SAP S4/HANA (OData meta-data property) | Medium | 4.3 |
| April 2025 | 3581961 | Code Injection Vulnerability in SAP S/4HANA (Private Cloud or On-Premise) | Critical | 9.9 |
| April 2025 | 3446649 | Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4 HANA (Learning Solution) | Medium | 4.6 |
| March 2025 | 3474392 | Missing Authorization check in S/4HANA (Manage Purchasing Info Records) | Medium | 4.3 |
| March 2025 | 3557131 | Missing Authorization check in SAP S/4HANA (RBD) | Medium | 4.3 |
| March 2025 | 3565835 | Broken Access Control vulnerabilities in SAP S/4HANA (Manage Bank Statements) | Medium | 4.3 |
| October 2024 | 3251893 | HTTP Verb Tampering in SAP S/4 HANA(Manage Bank Statements) | Medium | 4.3 |
| September 2024 | 3437585 | Information Disclosure in SAP S/4 HANA (Statutory Reports) | Medium | 4.3 |
| June 2024 | 3466175 | Missing Authorization check in SAP S/4HANA (Manage Incoming Payment Files) | Medium | 6.5 |
| May 2024 | 3460772 | Cross-Site Scripting (XSS) Vulnerability in SAP S/4HANA (Document Service Handler for DPS) | Medium | 6.1 |
| May 2024 | 3434666 | Missing Authorization Checks in SAP S/4 HANA (Manage Bank Statement Reprocessing Rules) | Medium | 4.3 |
| April 2024 | 3427178 | Missing Authorization check in SAP S/4 HANA (Cash Management) | Medium | 4.3 |
| April 2024 | 3430173 | Missing Authorization check in SAP S/4 HANA (Cash Management) | Medium | 4.3 |
| October 2023 | 3219846 | Missing Authorization Check In S/4HANA (Manage Withholding Tax Items) | Medium | 5.4 |
| September 2023 | 3369680 | External Entity Loop vulnerability in SAP S/4HANA (Create Single Payment application) | Low | 3.5 |
| August 2023 | 3156972 | URL Redirection vulnerability in SAP S/4HANA (Manage Catalog Items and Cross-Catalog search) | Medium | 6.1 |
| July 2023 | 3341211 | Improper Access Control in SAP S/4HANA (Manage Journal Entry Template) | Medium | 6.3 |
| February 2023 | 2985905 | SAP S/4 HANA Map Treasury Correspondence Format Data does not perform necessary authorization check for an authenticated user, resulting in escalation of privileges. | Medium | 6.5 |