SAP Security Patch Day: February 2026
Released February 10, 2026 · 26 notes · Source: CVE records on CVE.org (SAP as CNA)
Scheduled for February 10, 2026 (second Tuesday)
- SAP notes
- 26
- Critical
- 2
- High
- 6
- Highest CVSS
- 9.9
- Known exploited
- 0
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Our summary
26 notes with SAP CVEs. 2 Critical and 6 High (priority derived from CVSS, not SAP’s priority). Highest CVSS 9.9.
What to patch first
Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.
Code Injection vulnerability in SAP CRM and SAP S/4HANA (Scripting Editor)
Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform
XML Signature Wrapping in SAP NetWeaver AS ABAP and ABAP Platform
Denial of service (DOS) in SAP Supply Chain Management
Missing Authorization check in SAP Solution Tools Plug-In (ST-PI)
Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)
All notes
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Coverage: this site is built from SAP’s CVE records, so notes without a CVE, notes with only third-party CVEs (for example Apache or OpenSSL), and updates to earlier notes are not covered. That is about 7% of new notes.
Showing 26 of 26
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3697099 | Code Injection vulnerability in SAP CRM and SAP S/4HANA (Scripting Editor) New | SAP CRM and SAP S/4HANA | Critical | 9.9 | CVE-2026-0488 |
| 3674774 | Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Critical | 9.6 | CVE-2026-0509 |
| 3697567 | XML Signature Wrapping in SAP NetWeaver AS ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | High | 8.8 | CVE-2026-23687 |
| 3703092 | Denial of service (DOS) in SAP Supply Chain Management New | SAP Supply Chain Management | High | 7.7 | CVE-2026-23689 |
| 3705882 | Missing Authorization check in SAP Solution Tools Plug-In (ST-PI) New | SAP Solution Tools Plug-In | High | 7.7 | CVE-2026-24322 |
| 3654236 | Denial of service (DOS) in SAP BusinessObjects BI Platform New | SAP BusinessObjects BI Platform | High | 7.5 | CVE-2026-0490 |
| 3678282 | Denial of service (DOS) vulnerability in SAP BusinessObjects BI Platform New | SAP BusinessObjects BI Platform | High | 7.5 | CVE-2026-0485 |
| 3674246 | Open Redirect vulnerability in SAP BusinessObjects Business Intelligence Platform New | SAP BusinessObjects BI Platform | High | 7.3 | CVE-2026-0508 |
| 3672622 | Missing Authorization check in SAP NetWeaver Application Server ABAP and SAP S/4HANA New | SAP NetWeaver Application Server ABAP and SAP S/4HANA | Medium | 6.5 | CVE-2026-0484 |
| 3695912 | Denial of service (DOS) vulnerability in SAP BusinessObjects Business Intelligence Platform (AdminTools) New | SAP BusinessObjects BI Platform | Medium | 6.5 | CVE-2026-24324 |
| 3678417 | Multiple vulnerabilities in BSP Applications of SAP Document Management System New | SAP Document Management System | Medium | 6.1 | CVE-2026-0505, CVE-2026-24323 |
| 3688319 | Open Redirection vulnerability in Business Server Pages Application (TAF_APPLAUNCHER) New | Business Server Pages Application | Medium | 6.1 | CVE-2026-24328 |
| 3689543 | Race condition vulnerability in SAP Commerce Cloud New | SAP Commerce Cloud | Medium | 5.9 | CVE-2026-23684 |
| 3679346 | Information Disclosure Vulnerability in SAP Business One (B1 Client Memory Dump Files) New | SAP Business One | Medium | 5.8 | CVE-2026-24319 |
| 3687771 | Information Disclosure vulnerability in SAP Commerce Cloud New | SAP Commerce Cloud | Medium | 5.3 | CVE-2026-24321 |
| 3710111 | Missing authorization check in SAP Business Workflow New | SAP Business Workflow | Medium | 5.2 | CVE-2026-24312 |
| 3691645 | Missing Authorization Check in ABAP based SAP systems New | ABAP based SAP systems | Medium | 5.0 | CVE-2026-0486 |
| 3697256 | Cross Site Scripting (XSS) vulnerability in SAP BusinessObjects Enterprise (Central Management Console) New | SAP BusinessObjects Enterprise | Medium | 4.8 | CVE-2026-24325 |
| 3687285 | Insecure Deserialization vulnerability in SAP NetWeaver (JMS service) New | SAP NetWeaver | Medium | 4.4 | CVE-2026-23685 |
| 3215823 | Missing Authorization check in SAP Fiori App (Manage Service Entry Sheets - Lean Services) New | SAP Fiori | Medium | 4.3 | CVE-2026-23688 |
| 3646297 | Information Disclosure vulnerability in S/4HANA (Manage Payment Media) NewPublished outside Patch Day | SAP S/4HANA | Medium | 4.3 | CVE-2026-24314 |
| 3678009 | Missing authorization check in SAP S/4HANA Defense & Security (Disconnected Operations) New | SAP S/4HANA Defense & Security | Medium | 4.3 | CVE-2026-24326 |
| 3680390 | Missing Authorization Check in SAP Strategic Enterprise Management (Balanced Scorecard in BSP Application) New | SAP Strategic Enterprise Management | Medium | 4.3 | CVE-2026-24327 |
| 3680416 | Missing Authorization check in a function module in SAP Support Tools Plug-In New | SAP Support Tools Plug-In | Medium | 4.3 | CVE-2026-23681 |
| 3673213 | CRLF Injection vulnerability in SAP NetWeaver Application Server Java New | SAP NetWeaver AS Java | Low | 3.4 | CVE-2026-23686 |
| 3678313 | Memory Corruption vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP) New | SAP NetWeaver AS ABAP / ABAP Platform | Low | 3.1 | CVE-2026-24320 |