SAP Security Patch Day: March 2026
Released March 10, 2026 · 13 notes · Source: CVE records on CVE.org (SAP as CNA)
Scheduled for March 10, 2026 (second Tuesday)
- SAP notes
- 13
- Critical
- 1
- High
- 1
- Highest CVSS
- 9.1
- Known exploited
- 0
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Our summary
13 notes with SAP CVEs. 1 Critical and 1 High (priority derived from CVSS, not SAP’s priority). Highest CVSS 9.1.
What to patch first
Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.
Insecure Deserialization in SAP NetWeaver Enterprise Portal Administration
Denial of service (DOS) in SAP Supply Chain Management
Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)
All notes
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Coverage: this site is built from SAP’s CVE records, so notes without a CVE, notes with only third-party CVEs (for example Apache or OpenSSL), and updates to earlier notes are not covered. That is about 7% of new notes.
Showing 13 of 13
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3714585 | Insecure Deserialization in SAP NetWeaver Enterprise Portal Administration New | SAP NetWeaver Enterprise Portal Administration | Critical | 9.1 | CVE-2026-27685 |
| 3719502 | Denial of service (DOS) in SAP Supply Chain Management New | SAP Supply Chain Management | High | 7.7 | CVE-2026-27689 |
| 3689080 | Server-Side Request Forgery (SSRF) in SAP NetWeaver Application Server for ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.4 | CVE-2026-24316 |
| 3697355 | SQL Injection Vulnerability in SAP NetWeaver (Feedback Notification) New | SAP NetWeaver | Medium | 6.4 | CVE-2026-27684 |
| 3703856 | Missing Authorization check in SAP NetWeaver Application Server for ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.4 | CVE-2026-24309 |
| 3693543 | DOM-based Cross-Site Scripting (XSS) Vulnerability in SAP Business One (Job Service) New | SAP Business One | Medium | 6.1 | CVE-2026-0489 |
| 3703385 | Missing Authorization check in SAP Business Warehouse (Service API) New | SAP Business Warehouse | Medium | 5.9 | CVE-2026-27686 |
| 3701020 | Missing Authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal New | SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal | Medium | 5.8 | CVE-2026-27687 |
| 3708457 | Insecure Storage Protection vulnerability in SAP Customer Checkout 2.0 New | SAP Customer Checkout 2.0 | Medium | 5.6 | CVE-2026-24311 |
| 3699761 | DLL Hijacking vulnerability in SAP GUI for Windows with active GuiXT New | SAP GUI for Windows with active GuiXT | Medium | 5.0 | CVE-2026-24317 |
| 3704740 | Missing Authorization check in SAP NetWeaver Application Server for ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 5.0 | CVE-2026-27688 |
| 3707930 | Missing Authorization check in SAP Solution Tools Plug-In (ST-PI) New | SAP Solution Tools Plug-In | Medium | 5.0 | CVE-2026-24313 |
| 3694383 | Missing Authorization check in SAP NetWeaver Application Server for ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | Low | 3.5 | CVE-2026-24310 |