补丁日：2026年4月
发布于 2026年4月14日 · 21 条安全说明 · 来源：SAP 安全补丁日页面
计划日期：2026年4月14日（每月第二个星期二）
- 新发布
- 20
- 更新
- 1
- 严重
- 2
- 高
- 1
- 最高 CVSS
- 9.9
- 已被利用
- 0
本月摘要
共 21 条安全说明（新发布 20 条，更新 1 条），其中严重 2 条、高 1 条，最高 CVSS 9.9。
优先修补
排序依据：是否已知被利用（CISA KEV），其次是 SAP 优先级，再次是 CVSS 分数。仅供分诊参考，不能替代您自己的风险评估。
SQL Injection vulnerability in SAP Business Planning and Consolidation and SAP Business Warehouse
Malicious open-source packages in SAP Cloud Application Programming Model & MTA Build Tool
Missing Authorization check in SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise)
全部安全说明
SAP 简介中写明 19 条新安全说明和 1 条更新；SAP 表格共列出 21 行（两者可能不同，例如包含 GitHub 安全公告或补发条目）。
SAP 公告中的最高优先级在 2024 年 12 月及以前标为 “Hot News”，自 2024 年 10 月起标为 “Critical”；本站统一显示为“严重”。
显示 21 / 21
| 标题 | CVE | ||||
|---|---|---|---|---|---|
| 3719353 | SQL Injection vulnerability in SAP Business Planning and Consolidation and SAP Business Warehouse 新发布 | SAP Business Planning and Consolidation and SAP Business Warehouse | 严重 | 9.9 | CVE-2026-27681 |
| 3747787 | Malicious open-source packages in SAP Cloud Application Programming Model & MTA Build Tool 新发布补丁日之后发布 | SAP Cloud Application Programming Model & MTA Build Tool | 严重 | 0.0 | 无 CVE |
| 3731908 | Missing Authorization check in SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise) 新发布 | SAP ERP and SAP S/4 HANA | 高 | 7.1 | CVE-2026-34256 |
| 3680767 | Information Disclosure vulnerability in SAP Human Capital Management for SAP S/4HANA 新发布 | SAP Human Capital Management for SAP S/4HANA | 中 | 6.5 | CVE-2026-34264 |
| 3696239 | Denial of Service Vulnerability in SAP BusinessObjects Business Intelligence Platform 新发布 | SAP BusinessObjects BI Platform | 中 | 6.5 | CVE-2025-64775 |
| 3705094 | Missing Authorization check in SAP Business Analytics and SAP Content Management 新发布 | SAP Business Analytics and SAP Content Management | 中 | 6.5 | CVE-2026-34261 |
| 3715097 | Missing Authorization check in SAP S/4HANA OData Service (Manage Reference Equipment) 新发布 | SAP S/4HANA OData Service | 中 | 6.5 | CVE-2026-27677 |
| 3715177 | Missing Authorization check in SAP S/4HANA Backend OData Service (Manage Reference Structures) 新发布 | SAP S/4HANA Backend OData Service | 中 | 6.5 | CVE-2026-27678 |
| 3716767 | Missing Authorization check in SAP S/4HANA Frontend OData Service (Manage Reference Structures) 新发布 | SAP S/4HANA Frontend OData Service | 中 | 6.5 | CVE-2026-27679 |
| 3645228 | Cross-Site Scripting (XSS) vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog) 新发布 | SAP Supplier Relationship Management | 中 | 6.1 | CVE-2026-0512 |
| 3692004 | Open Redirect vulnerability in SAP NetWeaver Application Server ABAP 新发布 | SAP NetWeaver AS ABAP / ABAP Platform | 中 | 6.1 | CVE-2026-34257 |
| 3719397 | Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java) 新发布 | SAP NetWeaver AS Java | 中 | 6.1 | CVE-2026-27674 |
| 3730639 | Information Disclosure Vulnerability in SAP HANA Cockpit and HANA Database Explorer 新发布 | SAP HANA Cockpit and HANA Database Explorer | 中 | 5.0 | CVE-2026-34262 |
| 3703813 | Missing Authorization Check in SAP S/4HANA (Private Cloud and On-Premise) 新发布 | SAP S/4HANA | 中 | 4.9 | CVE-2026-27673 |
| 3530544 | Missing Authorization check in SAP S4CORE (Manage Journal Entries) 更新 | SAP S4CORE | 中 | 4.3 | CVE-2025-42899 |
| 3703276 | Missing Authorization check in Material Master Application 新发布 | Material Master Application | 中 | 4.3 | CVE-2026-27672 |
| 3711682 | Missing Authorization check in SAP S/4HANA OData Service (Manage Technical Object Structures) 新发布 | SAP S/4HANA OData Service | 中 | 4.3 | CVE-2026-27676 |
| 3702191 | Insecure Session Management vulnerability in SAP BusinessObjects Business Intelligence Platform 新发布 | SAP BusinessObjects BI Platform | 中 | 4.2 | CVE-2026-24318 |
| 3698216 | Reflected cross site scripting vulnerability in SAP BusinessObjects Business Intelligence Platform 新发布 | SAP BusinessObjects BI Platform | 中 | 4.1 | CVE-2026-27683 |
| 3665042 | CSS Injection vulnerability in SAP NetWeaver Application Server ABAP 新发布 | SAP NetWeaver AS ABAP / ABAP Platform | 低 | 3.1 | CVE-2026-27680 |
| 3723097 | Code Injection vulnerability in SAP Landscape Transformation 新发布 | SAP Landscape Transformation | 低 | 2.0 | CVE-2026-27675 |