AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Packages

SAP security advisories

70 advisories · 25 critical or high in 12 months · latest Oct 13

Advisories page

60 of 70 advisories

Critical 10.0Oct 13SAP Cloud: server-side request forgeryCVE-2026-89111fixed in 0.55.1Medium 5.3Sep 22SAP Fiori Launchpad: information disclosureCVE-2026-76974no fix yetMedium 4.3Sep 8SAP NetWeaver and ABAP Platform: missing authorizationCVE-2026-76963no fix yetHigh 7.8Sep 8SAP NetWeaver Business Client: code executionCVE-2026-76967no fix yetMedium 6.5Sep 8SAP Web Dispatcher, Internet: information disclosureCVE-2026-76968no fix yetCritical 9.4Sep 8SAP Cloud Application Programming Model (CAP): weakly protected credentialsCVE-2026-76969no fix yetMedium 6.5Sep 8SAP Manufacturing Integration and Intelligence: server-side request forgeryCVE-2026-76971no fix yetMedium 4.3Sep 8SAP UI5 does not sufficiently validate the parent frame's origin against the...CVE-2026-76977no fix yetHigh 8.5Sep 8SAP Integration Suite: resource exhaustionCVE-2026-76958no fix yetMedium 4.6Sep 8SAP S/4HANA: cross-site request forgeryCVE-2026-76959no fix yetLow 3.5Sep 8SAP S/4HANA: cross-site request forgeryCVE-2026-76960no fix yetLow 3.5Sep 8SAP S/4HANA: cross-site request forgeryCVE-2026-76961no fix yetMedium 4.3Sep 8SAP S/4HANA (Manage Bank Chains app): missing authorizationCVE-2026-76962no fix yetCritical 9.0Sep 8SAP NetWeaver (SAP GUI for Java): untrusted input in a security decisionCVE-2026-66768no fix yetCritical 9.8Sep 8SAP NetWeaver Message Server does not sufficiently validate the authenticity of...CVE-2026-58240no fix yetHigh 7.7Sep 8SAP NetWeaver Application Server for ABAP and ABAP Platform: integer underflowCVE-2026-66767no fix yetLow 2.2Sep 8SAP Process Integration (SOAP Adapter): XML entity expansionCVE-2026-58234no fix yetCritical 10.0Sep 8SAP Extended Passport (EPP) Processing: buffer overflowCVE-2026-44756no fix yetMedium 6.5Sep 8SAP S/4HANA (Intercompany Matching and Reconciliation): information disclosureCVE-2026-44766no fix yetHigh 7.5Aug 25SAP S/4HANA (Manage Supply Protection): denial of serviceCVE-2026-66766no fix yetCritical 10.0Aug 11SAP Commerce Cloud (Data Hub Adapter): remote code executionCVE-2026-58231no fix yetMedium 5.9Aug 11SAP Business AI Platform (Approuter): improper signature checkCVE-2026-66776no fix yetMedium 5.9Aug 11SAP Business AI Platform (Approuter): path traversalCVE-2026-66777no fix yetMedium 5.3Aug 11SAP Approuter does not sufficiently sanitize certain request headers before...CVE-2026-66778no fix yetMedium 6.3Aug 11SAP NetWeaver Application Server ABAP: cross-site scriptingCVE-2026-66779no fix yetHigh 7.9Aug 11SAP BusinessObjects Business Intelligence Platform (Central : hard-coded keyCVE-2026-66763no fix yetMedium 4.3Aug 11SAP S/4 HANA (Reprocess Bank Statement Items): privilege escalationCVE-2026-66764no fix yetMedium 6.3Aug 11SAP Social Intelligence: SQL injectionCVE-2026-66770no fix yetMedium 6.1Aug 11SAPUI5: cross-site scriptingCVE-2026-66771no fix yetMedium 4.3Aug 11SAP BusinessObjects Business Intelligence: missing authorizationCVE-2026-66772no fix yetMedium 5.9Aug 11SAP Odata: information disclosureCVE-2026-66773no fix yetLow 3.7Aug 11SAP Business AI Platform (Approuter): unchecked exceptional conditionCVE-2026-66774no fix yetMedium 4.3Aug 11SAP Business AI Platform (Approuter): cross-site request forgeryCVE-2026-66775no fix yetMedium 4.2Aug 11SAP NetWeaver and ABAP: missing authorizationCVE-2026-58241no fix yetHigh 8.8Aug 11SAP ABAP Developer Tools: missing authorizationCVE-2026-58243no fix yetMedium 4.3Aug 11SAP Manufacturing Integration and Intelligence: missing authorizationCVE-2026-58244no fix yetLow 3.8Aug 11SAP Advanced Planning and Optimization: hard-coded credentialsCVE-2026-58245no fix yetMedium 5.3Aug 11SAP ABAP Platform: uninitialized resourceCVE-2026-58247no fix yetMedium 6.5Aug 11SAP BusinessObjects Business Intelligence: XML external entityCVE-2026-58248no fix yetMedium 6.4Aug 11SAP Business AI Platform (Approuter): improper certificate validationCVE-2026-66760no fix yetMedium 4.3Aug 11SAP Business AI Platform (Approuter): resource exhaustionCVE-2026-66761no fix yetHigh 7.3Aug 11SAP Manufacturing Integration and Intelligence: missing authorizationCVE-2026-44764no fix yetHigh 7.3Aug 11SAP Manufacturing Integration and Intelligence: missing authorizationCVE-2026-44765no fix yetHigh 7.0Aug 11SAP Business AI Platform (Approuter): open redirectCVE-2026-58230no fix yetMedium 6.3Aug 11SAP NetWeaver Application Server JavaCVE-2026-58235no fix yetMedium 5.5Aug 11SAP NetWeaver Application Server ABAP and ABAP Platform: command injectionCVE-2026-58236no fix yetMedium 5.9Aug 11SAP Business AI Platform (Approuter): information disclosureCVE-2026-58237no fix yetMedium 5.9Aug 11SAP Business AI Platform (Approuter): resource exhaustionCVE-2026-58238no fix yetLow 3.7Aug 11SAP Business AI Platform (Approuter): untrusted input in a security decisionCVE-2026-58239no fix yetCritical 9.8Aug 11SAP NetWeaver and ABAP Platform: memory corruptionCVE-2026-34265no fix yetMedium 5.3Aug 11SAPSPrint Service: memory corruptionCVE-2026-40130no fix yetCritical 9.1Aug 11SAP Manufacturing Integration and Intelligence: code executionCVE-2026-44758no fix yetLow 3.7Aug 11SAP Data Services Management Console: clickjackingCVE-2026-44762no fix yetHigh 7.6Aug 11SAP Manufacturing Integration and Intelligence: path traversalCVE-2026-44763no fix yetMedium 4.3Jul 28SAP NetWeaver Application Server for ABAP: system information exposureCVE-2026-58246no fix yetCritical 9.1Jul 14SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented...CVE-2026-44761no fix yetMedium 6.1Jul 14SAP @ui5/webcomponents-base: clickjackingCVE-2026-44767no fix yetMedium 4.1Jul 14SAP WebClient UI: attacker could injectCVE-2026-44768no fix yetMedium 5.5Jul 14SAP S/4HANA Project Management (PPM-PRO): SQL injectionCVE-2026-44769no fix yetMedium 4.3Jul 14SAP S/4 HANA (Create Single Payment): missing authorizationCVE-2026-44770no fix yet
About SAP

Security advisories SAP publishes for its own products.

url.sap/sapsecuritypatchdaySAP

SAP elsewhere on Ibis: Acquisitions · Quarterly · Paydays · TechConf