SAP Security Patch Day: January 2026
Released January 13, 2026 · 18 notes · Source: CVE records on CVE.org (SAP as CNA)
Scheduled for January 13, 2026 (second Tuesday)
- SAP notes
- 18
- Critical
- 4
- High
- 4
- Highest CVSS
- 9.9
- Known exploited
- 0
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Our summary
18 notes with SAP CVEs. 4 Critical and 4 High (priority derived from CVSS, not SAP’s priority). Highest CVSS 9.9.
What to patch first
Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.
SQL Injection Vulnerability in SAP S/4HANA Private Cloud and On-Premise (Financials – General Ledger)
Remote code execution in SAP Wily Introscope Enterprise Manager (WorkStation)
Code Injection vulnerability in SAP S/4HANA (Private Cloud and On-Premise)
Code Injection vulnerability in SAP Landscape Transformation
Privilege escalation vulnerability in SAP HANA database
Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)
All notes
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Coverage: this site is built from SAP’s CVE records, so notes without a CVE, notes with only third-party CVEs (for example Apache or OpenSSL), and updates to earlier notes are not covered. That is about 7% of new notes.
Showing 18 of 18
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3687749 | SQL Injection Vulnerability in SAP S/4HANA Private Cloud and On-Premise (Financials – General Ledger) New | SAP S/4HANA Private Cloud and On-Premise | Critical | 9.9 | CVE-2026-0501 |
| 3668679 | Remote code execution in SAP Wily Introscope Enterprise Manager (WorkStation) New | SAP Wily Introscope Enterprise Manager | Critical | 9.6 | CVE-2026-0500 |
| 3694242 | Code Injection vulnerability in SAP S/4HANA (Private Cloud and On-Premise) New | SAP S/4HANA | Critical | 9.1 | CVE-2026-0498 |
| 3697979 | Code Injection vulnerability in SAP Landscape Transformation New | SAP Landscape Transformation | Critical | 9.1 | CVE-2026-0491 |
| 3691059 | Privilege escalation vulnerability in SAP HANA database New | SAP HANA database | High | 8.8 | CVE-2026-0492 |
| 3675151 | OS Command Injection vulnerability in SAP Application Server for ABAP and SAP NetWeaver RFCSDK New | SAP Application Server for ABAP and SAP NetWeaver RFCSDK | High | 8.4 | CVE-2026-0507 |
| 3565506 | Multiple vulnerabilities in SAP Fiori App (Intercompany Balance Reconciliation) New | SAP Fiori | High | 8.1 | CVE-2026-0495, CVE-2026-0496, CVE-2026-0511 |
| 3688703 | Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | High | 8.1 | CVE-2026-0506 |
| 3681523 | Missing Authorization check in in SAP ERP Central Component and SAP S/4HANA (SAP EHS Management) New | SAP ERP Central Component and SAP S/4HANA | Medium | 6.4 | CVE-2026-0503 |
| 3666061 | Cross-Site Scripting (XSS) vulnerability in SAP Business Connector New | SAP Business Connector | Medium | 6.1 | CVE-2026-0514 |
| 3687372 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal New | SAP NetWeaver Enterprise Portal | Medium | 6.1 | CVE-2026-0499 |
| 3638716 | Open Redirect Vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog) New | SAP Supplier Relationship Management | Medium | 4.7 | CVE-2026-0513 |
| 3122486 | Missing Authorization check in SAP Fiori App (Intercompany Balance Reconciliation) NewPublished outside Patch Day | SAP Fiori | Medium | 4.3 | CVE-2026-23683 |
| 3655227 | Information Disclosure vulnerability in SAP Fiori App (Intercompany Balance Reconciliation) New | SAP Fiori | Medium | 4.3 | CVE-2026-0494 |
| 3655229 | Cross-Site Request Forgery (CSRF) vulnerability in SAP Fiori App (Intercompany Balance Reconciliation) New | SAP Fiori | Medium | 4.3 | CVE-2026-0493 |
| 3677111 | Missing Authorization check in Business Server Pages Application (Product Designer Web UI) New | Business Server Pages Application | Medium | 4.3 | CVE-2026-0497 |
| 3657998 | Insufficient Input Handling in JNDI Operations of SAP Identity Management New | SAP Identity Management | Low | 3.8 | CVE-2026-0504 |
| 3593356 | Obsolete Encryption Algorithm Used in NW AS Java UME User Mapping New | NW AS Java UME User Mapping | Low | 3.0 | CVE-2026-0510 |