SAP Security Patch Day: May 2026
Released May 12, 2026 · 16 notes · Source: CVE records on CVE.org (SAP as CNA)
Scheduled for May 12, 2026 (second Tuesday)
- SAP notes
- 16
- Critical
- 2
- High
- 1
- Highest CVSS
- 9.6
- Known exploited
- 0
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Our summary
16 notes with SAP CVEs. 2 Critical and 1 High (priority derived from CVSS, not SAP’s priority). Highest CVSS 9.6.
What to patch first
Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.
SQL injection vulnerability in SAP S/4HANA (SAP Enterprise Search for ABAP)
Missing authentication check in SAP Commerce cloud configuration
OS Command Injection Vulnerability in SAP Forecasting & Replenishment
Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)
All notes
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Coverage: this site is built from SAP’s CVE records, so notes without a CVE, notes with only third-party CVEs (for example Apache or OpenSSL), and updates to earlier notes are not covered. That is about 7% of new notes.
Showing 16 of 16
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3724838 | SQL injection vulnerability in SAP S/4HANA (SAP Enterprise Search for ABAP) New | SAP S/4HANA | Critical | 9.6 | CVE-2026-34260 |
| 3733064 | Missing authentication check in SAP Commerce cloud configuration New | SAP Commerce cloud configuration | Critical | 9.6 | CVE-2026-34263 |
| 3732471 | OS Command Injection Vulnerability in SAP Forecasting & Replenishment New | SAP Forecasting & Replenishment | High | 8.2 | CVE-2026-34259 |
| 3730019 | OS Command Injection vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.5 | CVE-2026-40135 |
| 3718083 | Missing Authorization check in SAP S/4HANA Condition Maintenance New | SAP S/4HANA Condition Maintenance | Medium | 6.3 | CVE-2026-40133 |
| 3727717 | Cross-Site Scripting (XSS) vulnerability in Business Server Pages Application (TAF_APPLAUNCHER) New | Business Server Pages Application | Medium | 6.1 | CVE-2026-40137 |
| 3667593 | Cross Site Request Forgery (CSRF) in SAP BusinessObjects Business Intelligence Platform New | SAP BusinessObjects BI Platform | Medium | 5.4 | CVE-2026-0502 |
| 3721959 | Missing Authorization Check in SAP Strategic Enterprise Management (BSP application Balanced Scorecard Wizard) New | SAP Strategic Enterprise Management | Medium | 5.4 | CVE-2026-40132 |
| 3726583 | Content Spoofing vulnerability in SAPUI5 (Search UI) New | SAPUI5 | Medium | 4.7 | CVE-2026-34258 |
| 3728690 | Reflected Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on Business Server Pages) New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.7 | CVE-2026-27682 |
| 3433366 | Information Disclosure vulnerability in SAP Gateway NewPublished outside Patch Day | SAP Gateway | Medium | 4.3 | CVE-2026-44749 |
| 3713521 | Denial of service (DoS) in SAP Financial Consolidation New | SAP Financial Consolidation | Medium | 4.3 | CVE-2026-40136 |
| 3718508 | Missing Authorization Check in SAP Incentive and Commission Management New | SAP Incentive and Commission Management | Medium | 4.3 | CVE-2026-40134 |
| 3735359 | Code Injection vulnerability in SAP Application Server ABAP for SAP NetWeaver and ABAP Platform New | SAP Application Server ABAP for SAP NetWeaver and ABAP Platform | Medium | 4.3 | CVE-2026-40129 |
| 3726962 | SQL Injection vulnerability in SAP HANA Deployment Infrastructure (HDI) deploy library New | SAP HANA Deployment Infrastructure (HDI) deploy library | Low | 3.4 | CVE-2026-40131 |
| 3665042 | CSS Injection vulnerability in SAP NetWeaver Application Server ABAP NewPublished outside Patch Day | SAP NetWeaver AS ABAP / ABAP Platform | Low | 3.1 | CVE-2026-27680 |