SAP 安全补丁日：2026年8月
发布于 2026年8月11日 · 24 条安全说明 · 来源：CVE.org 上的 CVE 记录（SAP 为 CNA）
计划日期：2026年8月11日（每月第二个星期二）
- SAP 安全说明
- 23
- GitHub 公告
- 1
- 严重
- 3
- 高
- 6
- 最高 CVSS
- 10.0
- 已被利用
- 0
优先级依据 CVSS 推算，并非 SAP 的优先级：CVSS 9.0 及以上为严重，7.0 及以上为高，4.0 及以上为中，低于 4.0 为低。SAP 自己的优先级仅见于 SAP for Me（需要 SAP 登录）。
本月摘要
共 24 条带 SAP CVE 的安全说明，其中严重 3 条、高 6 条（优先级依据 CVSS 推算，并非 SAP 的优先级），最高 CVSS 10.0。
优先修补
排序依据：是否已知被利用（CISA KEV），其次是优先级（依据 CVSS 推算，并非 SAP 的优先级），再次是 CVSS 分数。仅供分诊参考，不能替代您自己的风险评估。
Improper Authorization in SAP Commerce Cloud (Data Hub Adapter)
Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform
Code Injection vulnerability in Manufacturing Integration and Intelligence
Privilege Escalation vulnerability in SAP ABAP Developer Tools
Credentials disclosure in SAP BusinessObjects Business Intelligence Platform (Central Management Server)
需要针对您自己的系统环境分诊本月的安全说明？ SAP 安全服务（digitaldisciple.dev）
全部安全说明
优先级依据 CVSS 推算，并非 SAP 的优先级：CVSS 9.0 及以上为严重，7.0 及以上为高，4.0 及以上为中，低于 4.0 为低。SAP 自己的优先级仅见于 SAP for Me（需要 SAP 登录）。
覆盖范围：本站依据 SAP 的 CVE 记录整理，因此没有 CVE 的安全说明、只有第三方 CVE（例如 Apache 或 OpenSSL）的安全说明，以及对早先安全说明的更新均未收录，约占新安全说明的 7%。
显示 24 / 24
| 标题 | CVE | ||||
|---|---|---|---|---|---|
| 3771065 | Improper Authorization in SAP Commerce Cloud (Data Hub Adapter) 新发布 | SAP Commerce Cloud | 严重 | 10.0 | CVE-2026-58231, CVE-2026-66766 |
| 3714806 | Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform 新发布 | SAP NetWeaver AS ABAP / ABAP Platform | 严重 | 9.8 | CVE-2026-34265 |
| 3758900 | Code Injection vulnerability in Manufacturing Integration and Intelligence 新发布 | SAP Manufacturing Integration and Intelligence | 严重 | 9.1 | CVE-2026-44758 |
| 3772411 | Privilege Escalation vulnerability in SAP ABAP Developer Tools 新发布 | SAP ABAP Developer Tools | 高 | 8.8 | CVE-2026-58243 |
| 3756565 | Credentials disclosure in SAP BusinessObjects Business Intelligence Platform (Central Management Server) 新发布 | SAP BusinessObjects BI Platform | 高 | 7.9 | CVE-2026-66763 |
| 3759854 | Directory Traversal vulnerability in SAP Manufacturing Integration and Intelligence 新发布 | SAP Manufacturing Integration and Intelligence | 高 | 7.6 | CVE-2026-44763 |
| 3758657 | Missing Authorization Check in SAP Manufacturing Integration and Intelligence 新发布 | SAP Manufacturing Integration and Intelligence | 高 | 7.3 | CVE-2026-44765 |
| 3758910 | Missing Authorization Check in SAP Manufacturing Integration and Intelligence 新发布 | SAP Manufacturing Integration and Intelligence | 高 | 7.3 | CVE-2026-44764 |
| 3786038 | Multiple vulnerabilities in SAP Business AI Platform (Approuter) 新发布 | SAP Business AI Platform | 高 | 7.0 | CVE-2026-58230, CVE-2026-58237, CVE-2026-58238, CVE-2026-58239, CVE-2026-66760, CVE-2026-66761, CVE-2026-66774, CVE-2026-66775, CVE-2026-66776, CVE-2026-66777, CVE-2026-66778 |
| 3753141 | XML External Entity Injection in SAP BusinessObjects Business Intelligence 新发布 | SAP BusinessObjects BI Platform | 中 | 6.5 | CVE-2026-58248 |
| 3721424 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP 新发布 | SAP NetWeaver AS ABAP / ABAP Platform | 中 | 6.3 | CVE-2026-66779 |
| 3758318 | Use of Vulnerable Third-Party Component in SAP NetWeaver AS Java (Adobe Document Services) 新发布 | SAP NetWeaver AS Java | 中 | 6.3 | CVE-2026-58235 |
| 3766473 | SQL Injection vulnerability in SAP Social Intelligence 新发布 | SAP Social Intelligence | 中 | 6.3 | CVE-2026-66770 |
| 3772071 | Cross Site Scripting (XSS) vulnerability in SAPUI5 新发布 | SAPUI5 | 中 | 6.1 | CVE-2026-66771 |
| GHSA-hc5j-q32w-c25v | Server-controlled `__next` URL is not checking cross-origin 新发布 | Odata | 中 | 5.9 | CVE-2026-66773 |
| 3745182 | OS Command Injection vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform 新发布 | SAP NetWeaver AS ABAP / ABAP Platform | 中 | 5.5 | CVE-2026-58236 |
| 3725940 | Memory Corruption vulnerability in SAPSPrint Service 新发布 | SAPSPrint Service | 中 | 5.3 | CVE-2026-40130 |
| 3756674 | Memory Corruption vulnerability in SAP ABAP Platform 新发布 | SAP ABAP Platform | 中 | 5.3 | CVE-2026-58247 |
| 3669608 | Missing Authorization check in SAP S/4 HANA (Reprocess Bank Statement Items) 新发布 | SAP S/4HANA | 中 | 4.3 | CVE-2026-66764 |
| 3770649 | Missing Authorization Check in SAP BusinessObjects Business Intelligence Platform (Admin Tools) 新发布 | SAP BusinessObjects BI Platform | 中 | 4.3 | CVE-2026-66772 |
| 3781137 | Missing Authorization Check in SAP Manufacturing Integration and Intelligence (MII) 新发布 | SAP Manufacturing Integration and Intelligence | 中 | 4.3 | CVE-2026-58244 |
| 3752864 | Missing Authorization Check in SAP NetWeaver and ABAP Platform (Change and Transport System - Customer Transport Integration Wizard) 新发布 | SAP NetWeaver AS ABAP / ABAP Platform | 中 | 4.2 | CVE-2026-58241 |
| 3763028 | Hard-coded Credentials in SAP Advanced Planning and Optimization (Model Mix Planning) 新发布 | SAP Advanced Planning and Optimization | 低 | 3.8 | CVE-2026-58245 |
| 3739913 | Security Misconfiguration in SAP Data Services Management Console 新发布 | SAP Data Services Management Console | 低 | 3.7 | CVE-2026-44762 |