SAP Security Patch Day: June 2026
Released June 9, 2026 · 12 notes · Source: CVE records on CVE.org (SAP as CNA)
Scheduled for June 9, 2026 (second Tuesday)
- SAP notes
- 12
- Critical
- 3
- High
- 1
- Highest CVSS
- 9.9
- Known exploited
- 0
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Our summary
12 notes with SAP CVEs. 3 Critical and 1 High (priority derived from CVSS, not SAP’s priority). Highest CVSS 9.9.
What to patch first
Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.
XML Signature Wrapping in SAML Authentication in SAP NetWeaver AS ABAP and ABAP Platform
Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform
Directory Traversal vulnerability in SAP NetWeaver Application Server Java (Web Container)
Missing Authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform
Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)
All notes
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Coverage: this site is built from SAP’s CVE records, so notes without a CVE, notes with only third-party CVEs (for example Apache or OpenSSL), and updates to earlier notes are not covered. That is about 7% of new notes.
Showing 12 of 12
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3746332 | XML Signature Wrapping in SAML Authentication in SAP NetWeaver AS ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Critical | 9.9 | CVE-2026-44748 |
| 3717897 | Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Critical | 9.8 | CVE-2026-27671 |
| 3727078 | Directory Traversal vulnerability in SAP NetWeaver Application Server Java (Web Container) New | SAP NetWeaver AS Java | Critical | 9.0 | CVE-2026-40128 |
| 3735546 | Missing Authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | High | 7.1 | CVE-2026-44751 |
| 3748819 | Missing caller identification check-in for ODP Data Replication APIs New | ODP Data Replication APIs | Medium | 6.6 | CVE-2026-44754 |
| 3751691 | SQL Injection vulnerability in SAP S/4HANA New | SAP S/4HANA | Medium | 6.5 | CVE-2026-44744 |
| 3723655 | Reflected Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS Java (JDBC Test Servlet) New | SAP NetWeaver AS Java | Medium | 6.1 | CVE-2026-44746 |
| 3715280 | Cross-Site Scripting (XSS) vulnerability in SAP Wily Introscope Enterprise Manager New | SAP Wily Introscope Enterprise Manager | Medium | 4.7 | CVE-2026-44757 |
| 3673181 | Missing Authorization check in SAP MDG (Review Match Groups Application) New | SAP MDG | Medium | 4.3 | CVE-2026-44750 |
| 3687096 | Email Spoofing vulnerability in SAP Business Objects Business Intelligence Platform New | SAP BusinessObjects BI Platform | Medium | 4.3 | CVE-2026-44755 |
| 3682699 | Path Traversal Vulnerability in SAP Fiori (launchpad) New | SAP Fiori | Medium | 4.2 | CVE-2026-24315 |
| 3706000 | Security Misconfiguration vulnerability in SAP Business Objects New | SAP BusinessObjects BI Platform | Low | 3.7 | CVE-2026-44743 |