Patch Day: May 2026
Released May 12, 2026 · 16 notes · Source: SAP Security Patch Day page
Scheduled for May 12, 2026 (second Tuesday)
- New
- 16
- Updated
- 0
- Critical
- 2
- High
- 1
- Highest CVSS
- 9.6
- Known exploited
- 0
Our summary
16 notes (16 new, 0 updated). 2 Critical and 1 High. Highest CVSS 9.6.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
SQL injection vulnerability in SAP S/4HANA (SAP Enterprise Search for ABAP)
Missing authentication check in SAP Commerce cloud configuration
OS Command Injection Vulnerability in SAP Forecasting & Replenishment
All notes
SAP’s introduction states 15 new notes and 0 updates; SAP’s table lists 16 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 16 of 16
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3724838 | SQL injection vulnerability in SAP S/4HANA (SAP Enterprise Search for ABAP) New | SAP S/4HANA | Critical | 9.6 | CVE-2026-34260 |
| 3733064 | Missing authentication check in SAP Commerce cloud configuration New | SAP Commerce Cloud | Critical | 9.6 | CVE-2026-34263 |
| 3732471 | OS Command Injection Vulnerability in SAP Forecasting & Replenishment New | SAP Forecasting & Replenishment | High | 8.2 | CVE-2026-34259 |
| 3730019 | OS Command Injection vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.5 | CVE-2026-40135 |
| 3718083 | Missing Authorization check in SAP S/4HANA Condition Maintenance New | SAP S/4HANA Condition Maintenance | Medium | 6.3 | CVE-2026-40133 |
| 3727717 | Cross-Site Scripting (XSS) vulnerability in Business Server Pages Application (TAF_APPLAUNCHER) New | Business Server Pages Application | Medium | 6.1 | CVE-2026-40137 |
| 3667593 | Cross Site Request Forgery (CSRF) in SAP BusinessObjects Business Intelligence Platform New | SAP BusinessObjects BI Platform | Medium | 5.4 | CVE-2026-0502 |
| 3721959 | Missing Authorization Check in SAP Strategic Enterprise Management (BSP application Balanced Scorecard Wizard) New | SAP Strategic Enterprise Management | Medium | 5.4 | CVE-2026-40132 |
| 3716450 | Potential Improper Certificate Validation in SAP Commerce Cloud (Apache Log4j) New | SAP Commerce Cloud | Medium | 4.8 | CVE-2025-68161 |
| 3726583 | Content Spoofing vulnerability in SAPUI5 (Search UI) New | SAPUI5 | Medium | 4.7 | CVE-2026-34258 |
| 3728690 | Reflected Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on Business Server Pages) New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.7 | CVE-2026-27682 |
| 3433366 | Information Disclosure vulnerability in SAP Gateway New | SAP Gateway | Medium | 4.3 | CVE-2026-44749 |
| 3713521 | Denial of service (DoS) in SAP Financial Consolidation New | SAP Financial Consolidation | Medium | 4.3 | CVE-2026-40136 |
| 3718508 | Missing Authorization Check in SAP Incentive and Commission Management New | SAP Incentive and Commission Management | Medium | 4.3 | CVE-2026-40134 |
| 3735359 | Code Injection vulnerability in SAP Application Server ABAP for SAP NetWeaver and ABAP Platform New | SAP Application Server ABAP for SAP NetWeaver and ABAP Platform | Medium | 4.3 | CVE-2026-40129 |
| 3726962 | SQL Injection vulnerability in SAP HANA Deployment Infrastructure (HDI) deploy library New | SAP HANA Deployment Infrastructure (HDI) deploy library | Low | 3.4 | CVE-2026-40131 |