Patch Day: February 2026
Released February 10, 2026 · 29 notes · Source: SAP Security Patch Day page
Scheduled for February 10, 2026 (second Tuesday)
- New
- 27
- Updated
- 2
- Critical
- 2
- High
- 7
- Highest CVSS
- 9.9
- Known exploited
- 0
Our summary
29 notes (27 new, 2 updated). 2 Critical and 7 High. Highest CVSS 9.9.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Code Injection vulnerability in SAP CRM and SAP S/4HANA (Scripting Editor)
Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform
XML Signature Wrapping in SAP NetWeaver AS ABAP and ABAP Platform
Denial of service (DOS) in SAP Supply Chain Management
Missing Authorization check in SAP Solution Tools Plug-In (ST-PI)
All notes
SAP’s introduction states 26 new notes and 1 updates; SAP’s table lists 29 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 29 of 29
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3697099 | Code Injection vulnerability in SAP CRM and SAP S/4HANA (Scripting Editor) New | SAP CRM and SAP S/4HANA | Critical | 9.9 | CVE-2026-0488 |
| 3674774 | Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Critical | 9.6 | CVE-2026-0509 |
| 3697567 | XML Signature Wrapping in SAP NetWeaver AS ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | High | 8.8 | CVE-2026-23687 |
| 3703092 | Denial of service (DOS) in SAP Supply Chain Management New | SAP Supply Chain Management | High | 7.7 | CVE-2026-23689 |
| 3705882 | Missing Authorization check in SAP Solution Tools Plug-In (ST-PI) New | SAP Solution Tools Plug-In | High | 7.7 | CVE-2026-24322 |
| 3654236 | Denial of service (DOS) in SAP BusinessObjects BI Platform New | SAP BusinessObjects BI Platform | High | 7.5 | CVE-2026-0490 |
| 3678282 | Denial of service (DOS) vulnerability in SAP BusinessObjects BI Platform New | SAP BusinessObjects BI Platform | High | 7.5 | CVE-2026-0485 |
| 3692405 | Race Condition in SAP Commerce Cloud New | SAP Commerce Cloud | High | 7.4 | CVE-2025-12383 |
| 3674246 | Open Redirect vulnerability in SAP BusinessObjects Business Intelligence Platform New | SAP BusinessObjects BI Platform | High | 7.3 | CVE-2026-0508 |
| 3672622 | Missing Authorization check in SAP NetWeaver Application Server ABAP and SAP S/4HANA New | SAP NetWeaver Application Server ABAP and SAP S/4HANA | Medium | 6.5 | CVE-2026-0484 |
| 3695912 | Denial of service (DOS) vulnerability in SAP BusinessObjects Business Intelligence Platform (AdminTools) New | SAP BusinessObjects BI Platform | Medium | 6.5 | CVE-2026-24324 |
| 3678417 | Multiple vulnerabilities in BSP Applications of SAP Document Management System New | SAP Document Management System | Medium | 6.1 | CVE-2026-0505, CVE-2026-24323 |
| 3688319 | Open Redirection vulnerability in Business Server Pages Application (TAF_APPLAUNCHER) New | Business Server Pages Application | Medium | 6.1 | CVE-2026-24328 |
| 3503138 | Information Disclosure vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML) Update | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.0 | CVE-2025-0059 |
| 3689543 | Race condition vulnerability in SAP Commerce Cloud New | SAP Commerce Cloud | Medium | 5.9 | CVE-2026-23684 |
| 3679346 | Information Disclosure Vulnerability in SAP Business One (B1 Client Memory Dump Files) New | SAP Business One | Medium | 5.8 | CVE-2026-24319 |
| 3687771 | Information Disclosure vulnerability in SAP Commerce Cloud New | SAP Commerce Cloud | Medium | 5.3 | CVE-2026-24321 |
| 3710111 | Missing authorization check in SAP Business Workflow New | SAP Business Workflow | Medium | 5.2 | CVE-2026-24312 |
| 3691645 | Missing Authorization Check in ABAP based SAP systems New | ABAP based SAP systems | Medium | 5.0 | CVE-2026-0486 |
| 3697256 | Cross Site Scripting (XSS) vulnerability in SAP BusinessObjects Enterprise (Central Management Console) New | SAP BusinessObjects Enterprise | Medium | 4.8 | CVE-2026-24325 |
| 3396109 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Business Client for HTML UpdateReleased after Patch Day | SAP NWBC for HTML | Medium | 4.7 | CVE-2024-22128 |
| 3687285 | Insecure Deserialization vulnerability in SAP NetWeaver (JMS service) New | SAP NetWeaver | Medium | 4.4 | CVE-2026-23685 |
| 3215823 | Missing Authorization check in SAP Fiori App (Manage Service Entry Sheets - Lean Services) New | SAP Fiori | Medium | 4.3 | CVE-2026-23688 |
| 3646297 | Information Disclosure vulnerability in SAP S/4HANA (Manage Payment Media) NewReleased after Patch Day | SAP S/4HANA | Medium | 4.3 | CVE-2026-24314 |
| 3678009 | Missing authorization check in SAP S/4HANA Defense & Security (Disconnected Operations) New | SAP S/4HANA Defense & Security | Medium | 4.3 | CVE-2026-24326 |
| 3680390 | Missing Authorization Check in SAP Strategic Enterprise Management (Balanced Scorecard in BSP Application) New | SAP Strategic Enterprise Management | Medium | 4.3 | CVE-2026-24327 |
| 3680416 | Missing Authorization check in a function module in SAP Support Tools Plug-In New | SAP Support Tools Plug-In | Medium | 4.3 | CVE-2026-23681 |
| 3673213 | CRLF Injection vulnerability in SAP NetWeaver Application Server Java New | SAP NetWeaver AS Java | Low | 3.4 | CVE-2026-23686 |
| 3678313 | Memory Corruption vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP) New | SAP NetWeaver AS ABAP / ABAP Platform | Low | 3.1 | CVE-2026-24320 |