SAP Security Patch Day: August 2026
Released August 11, 2026 · 24 notes · Source: CVE records on CVE.org (SAP as CNA)
Scheduled for August 11, 2026 (second Tuesday)
- SAP notes
- 23
- GitHub advisories
- 1
- Critical
- 3
- High
- 6
- Highest CVSS
- 10.0
- Known exploited
- 0
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Our summary
24 notes with SAP CVEs. 3 Critical and 6 High (priority derived from CVSS, not SAP’s priority). Highest CVSS 10.0.
What to patch first
Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.
Improper Authorization in SAP Commerce Cloud (Data Hub Adapter)
Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform
Code Injection vulnerability in Manufacturing Integration and Intelligence
Privilege Escalation vulnerability in SAP ABAP Developer Tools
Credentials disclosure in SAP BusinessObjects Business Intelligence Platform (Central Management Server)
Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)
All notes
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Coverage: this site is built from SAP’s CVE records, so notes without a CVE, notes with only third-party CVEs (for example Apache or OpenSSL), and updates to earlier notes are not covered. That is about 7% of new notes.
Showing 24 of 24
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3771065 | Improper Authorization in SAP Commerce Cloud (Data Hub Adapter) New | SAP Commerce Cloud | Critical | 10.0 | CVE-2026-58231, CVE-2026-66766 |
| 3714806 | Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Critical | 9.8 | CVE-2026-34265 |
| 3758900 | Code Injection vulnerability in Manufacturing Integration and Intelligence New | SAP Manufacturing Integration and Intelligence | Critical | 9.1 | CVE-2026-44758 |
| 3772411 | Privilege Escalation vulnerability in SAP ABAP Developer Tools New | SAP ABAP Developer Tools | High | 8.8 | CVE-2026-58243 |
| 3756565 | Credentials disclosure in SAP BusinessObjects Business Intelligence Platform (Central Management Server) New | SAP BusinessObjects BI Platform | High | 7.9 | CVE-2026-66763 |
| 3759854 | Directory Traversal vulnerability in SAP Manufacturing Integration and Intelligence New | SAP Manufacturing Integration and Intelligence | High | 7.6 | CVE-2026-44763 |
| 3758657 | Missing Authorization Check in SAP Manufacturing Integration and Intelligence New | SAP Manufacturing Integration and Intelligence | High | 7.3 | CVE-2026-44765 |
| 3758910 | Missing Authorization Check in SAP Manufacturing Integration and Intelligence New | SAP Manufacturing Integration and Intelligence | High | 7.3 | CVE-2026-44764 |
| 3786038 | Multiple vulnerabilities in SAP Business AI Platform (Approuter) New | SAP Business AI Platform | High | 7.0 | CVE-2026-58230, CVE-2026-58237, CVE-2026-58238, CVE-2026-58239, CVE-2026-66760, CVE-2026-66761, CVE-2026-66774, CVE-2026-66775, CVE-2026-66776, CVE-2026-66777, CVE-2026-66778 |
| 3753141 | XML External Entity Injection in SAP BusinessObjects Business Intelligence New | SAP BusinessObjects BI Platform | Medium | 6.5 | CVE-2026-58248 |
| 3721424 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.3 | CVE-2026-66779 |
| 3758318 | Use of Vulnerable Third-Party Component in SAP NetWeaver AS Java (Adobe Document Services) New | SAP NetWeaver AS Java | Medium | 6.3 | CVE-2026-58235 |
| 3766473 | SQL Injection vulnerability in SAP Social Intelligence New | SAP Social Intelligence | Medium | 6.3 | CVE-2026-66770 |
| 3772071 | Cross Site Scripting (XSS) vulnerability in SAPUI5 New | SAPUI5 | Medium | 6.1 | CVE-2026-66771 |
| GHSA-hc5j-q32w-c25v | Server-controlled `__next` URL is not checking cross-origin New | Odata | Medium | 5.9 | CVE-2026-66773 |
| 3745182 | OS Command Injection vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 5.5 | CVE-2026-58236 |
| 3725940 | Memory Corruption vulnerability in SAPSPrint Service New | SAPSPrint Service | Medium | 5.3 | CVE-2026-40130 |
| 3756674 | Memory Corruption vulnerability in SAP ABAP Platform New | SAP ABAP Platform | Medium | 5.3 | CVE-2026-58247 |
| 3669608 | Missing Authorization check in SAP S/4 HANA (Reprocess Bank Statement Items) New | SAP S/4HANA | Medium | 4.3 | CVE-2026-66764 |
| 3770649 | Missing Authorization Check in SAP BusinessObjects Business Intelligence Platform (Admin Tools) New | SAP BusinessObjects BI Platform | Medium | 4.3 | CVE-2026-66772 |
| 3781137 | Missing Authorization Check in SAP Manufacturing Integration and Intelligence (MII) New | SAP Manufacturing Integration and Intelligence | Medium | 4.3 | CVE-2026-58244 |
| 3752864 | Missing Authorization Check in SAP NetWeaver and ABAP Platform (Change and Transport System - Customer Transport Integration Wizard) New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.2 | CVE-2026-58241 |
| 3763028 | Hard-coded Credentials in SAP Advanced Planning and Optimization (Model Mix Planning) New | SAP Advanced Planning and Optimization | Low | 3.8 | CVE-2026-58245 |
| 3739913 | Security Misconfiguration in SAP Data Services Management Console New | SAP Data Services Management Console | Low | 3.7 | CVE-2026-44762 |