Patch Day: August 2026
Released August 11, 2026 · 32 notes · Source: SAP Security Patch Day page
Scheduled for August 11, 2026 (second Tuesday)
- New
- 30
- Updated
- 2
- Critical
- 4
- High
- 9
- Highest CVSS
- 10.0
- Known exploited
- 0
Our summary
32 notes (30 new, 2 updated). 4 Critical and 9 High. Highest CVSS 10.0.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Improper Authorization in SAP Commerce Cloud (Data Hub Adapter)
Code Injection vulnerability in SAP Manufacturing Integration and Intelligence
Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform
Code Injection vulnerability in Manufacturing Integration and Intelligence
Privilege Escalation vulnerability in SAP ABAP Developer Tools
All notes
SAP’s introduction states 28 new notes and 2 updates; SAP’s table lists 32 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 32 of 32
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3771065 | Improper Authorization in SAP Commerce Cloud (Data Hub Adapter) New | SAP Commerce Cloud | Critical | 10.0 | CVE-2026-58231 |
| 3765948 | Code Injection vulnerability in SAP Manufacturing Integration and Intelligence New | SAP Manufacturing Integration and Intelligence | Critical | 9.9 | CVE-2026-44772 |
| 3714806 | Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Critical | 9.8 | CVE-2026-34265 |
| 3758900 | Code Injection vulnerability in Manufacturing Integration and Intelligence New | SAP Manufacturing Integration and Intelligence | Critical | 9.1 | CVE-2026-44758 |
| 3772411 | Privilege Escalation vulnerability in SAP ABAP Developer Tools New | SAP ABAP Developer Tools | High | 8.8 | CVE-2026-58243 |
| 3773203 | Potential buffer overflow vulnerability affects SAP Commerce Cloud in public‑cloud deployments with NGINX New | SAP Commerce Cloud | High | 8.1 | CVE-2026-42945 |
| 3756565 | Credentials disclosure in SAP BusinessObjects Business Intelligence Platform (Central Management Server) New | SAP BusinessObjects BI Platform | High | 7.9 | CVE-2026-66763 |
| 3759854 | Directory Traversal vulnerability in SAP Manufacturing Integration and Intelligence New | SAP Manufacturing Integration and Intelligence | High | 7.6 | CVE-2026-44763 |
| 3773304 | Remote Code Execution vulnerability in Enhanced Change and Transport System (CTS+) Attach Tool (ctsattach) Update | Enhanced Change and Transport System (CTS+) Attach Tool | High | 7.6 | CVE-2026-58233 |
| 3485073 | Denial of Service (DoS) due to use of third-party component in SAP S/4HANA (Manage Supply Protection) New | SAP S/4HANA | High | 7.5 | CVE-2026-66766 |
| 3758657 | Missing Authorization Check in SAP Manufacturing Integration and Intelligence New | SAP Manufacturing Integration and Intelligence | High | 7.3 | CVE-2026-44765 |
| 3758910 | Missing Authorization Check in SAP Manufacturing Integration and Intelligence New | SAP Manufacturing Integration and Intelligence | High | 7.3 | CVE-2026-44764 |
| 3786038 | Multiple vulnerabilities in SAP Business AI Platform (Approuter) New | SAP Business AI Platform | High | 7.0 | CVE-2026-58230, CVE-2026-66775, CVE-2026-66778, CVE-2026-66760, CVE-2026-66761, CVE-2026-66777, CVE-2026-66776, CVE-2026-66774, CVE-2026-58237, CVE-2026-58238, CVE-2026-58239 |
| 3753141 | XML External Entity Injection in SAP BusinessObjects Business Intelligence New | SAP BusinessObjects BI Platform | Medium | 6.5 | CVE-2026-58248 |
| 3757815 | Potential Information Disclosure vulnerability in SAP Commerce Cloud (Bouncy Castle Java library) New | SAP Commerce Cloud | Medium | 6.5 | CVE-2026-5598 |
| 3770868 | Improper Output Encoding Vulnerability in SAP Commerce Cloud and SAP Data Hub (Apache Log4j Core) New | SAP Commerce Cloud and SAP Data Hub | Medium | 6.5 | CVE-2026-34480 |
| 3721424 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.3 | CVE-2026-66779 |
| 3758318 | Use of Vulnerable Third-Party Component in SAP NetWeaver AS Java (Adobe Document Services) New | SAP NetWeaver AS Java | Medium | 6.3 | CVE-2026-58235 |
| 3766473 | SQL Injection vulnerability in SAP Social Intelligence New | SAP Social Intelligence | Medium | 6.3 | CVE-2026-66770 |
| 3772071 | Cross Site Scripting (XSS) vulnerability in SAPUI5 New | SAPUI5 | Medium | 6.1 | CVE-2026-66771 |
| GHSA-hc5j-q32w-c25v | Server-controlled `__next` URL is not checking cross-origin New | No SAP products impacted | Medium | 5.9 | CVE-2026-66773 |
| 3540688 | Code Injection vulnerability in SAP FICA ODN framework Update | SAP FICA ODN framework | Medium | 5.5 | CVE-2025-42947 |
| 3745182 | OS Command Injection vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 5.5 | CVE-2026-58236 |
| 3725940 | Memory Corruption vulnerability in SAPSPrint Service New | SAPSPrint Service | Medium | 5.3 | CVE-2026-40130 |
| 3756674 | Memory Corruption vulnerability in SAP ABAP Platform New | SAP ABAP Platform | Medium | 5.3 | CVE-2026-58247 |
| 3778462 | Security Vulnerabilities in SAP Commerce Cloud (Search and Navigation) New | SAP Commerce Cloud | Medium | 4.8 | CVE-2026-33871, CVE-2025-58057 |
| 3669608 | Missing Authorization check in SAP S/4 HANA (Reprocess Bank Statement Items) New | SAP S/4HANA | Medium | 4.3 | CVE-2026-66764 |
| 3770649 | Missing Authorization Check in SAP BusinessObjects Business Intelligence Platform (Admin Tools) New | SAP BusinessObjects BI Platform | Medium | 4.3 | CVE-2026-66772 |
| 3781137 | Missing Authorization Check in SAP Manufacturing Integration and Intelligence (MII) New | SAP Manufacturing Integration and Intelligence | Medium | 4.3 | CVE-2026-58244 |
| 3752864 | Missing Authorization Check in SAP NetWeaver and ABAP Platform (Change and Transport System - Customer Transport Integration Wizard) New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.2 | CVE-2026-58241 |
| 3763028 | Hard-coded Credentials in SAP Advanced Planning and Optimization (Model Mix Planning) New | SAP Advanced Planning and Optimization | Low | 3.8 | CVE-2026-58245 |
| 3739913 | Security Misconfiguration in SAP Data Services Management Console New | SAP Data Services Management Console | Low | 3.7 | CVE-2026-44762 |