On 11 August 2026, SAP released 28 new security notes alongside 1 GitHub Security Advisory (GHSA-hc5j-q32w-c25v), with 2 supplementary updates to previously published notes (Notes 3773304 and 3540688), bringing the total to 31 tracked remediation items. The severity distribution comprises 4 Critical (CVSS 9.1–10.0), 8 High (CVSS 7.0–8.8), 17 Medium (CVSS 4.2–6.5), and 2 Low (CVSS 3.7–3.8) priority vulnerabilities. The release is dominated by code injection and authorization bypass flaws concentrated in SAP Manufacturing Integration and Intelligence and SAP Commerce Cloud, with kernel-level memory corruption in the ABAP runtime representing the most severe single threat to on-premise landscapes.
The dominant pattern this month shifts heavily toward application-layer injection vectors and third-party component exposure rather than core kernel exploits. Six of the thirty-one entries target SAP MII alone, spanning SSRF-driven code injection, directory traversal, and multiple missing authorization checks—indicating a systemic weakness in input validation across the MII 15.4/15.5 codebase. Simultaneously, SAP Commerce Cloud and its Data Hub Adapter surface five distinct vulnerabilities, four of which stem from embedded open-source libraries (NGINX, Bouncy Castle, Netty, Apache Log4j Core), pointing to a growing software supply-chain risk in SAP’s cloud-delivered commerce stack. The ABAP Platform kernel, while affected by only three notes, carries the highest individual CVSS score (9.8) for an unauthenticated, network-reachable memory corruption in DIAG protocol parsing, making it the single most urgent patch for any on-premise NetWeaver deployment.
Key Highlights by Severity
Critical Priority (CVSS 9.0 - 10.0)
- Improper Authorization in SAP Commerce Cloud – Data Hub Adapter (Note 3771065, CVSS 10.0): An unauthenticated, remote attacker can abuse a default authentication client to submit specially crafted input to the Data Hub Adapter’s import endpoint, which lacks sufficient validation. Successful exploitation enables arbitrary code execution and compromise of internal components, resulting in maximum impact across confidentiality, integrity, and availability. No user interaction or prior credentials are required; the attack vector is network-based with low complexity. A temporary workaround exists—restricting the /datahubadapter/import/** endpoint via an IP Filter Set to known DataHub server egress addresses—but SAP explicitly designates this as non-permanent. Permanent remediation requires deploying Update Release 2211-jdk21.17 or 2211.55 and rebuilding/redeploying the Commerce Cloud application.
- Code Injection via SSRF in SAP Manufacturing Integration and Intelligence (Note 3765948, CVSS 9.9): A low-privileged attacker can submit crafted input that triggers a server-side request forgery during XSL transformations, causing the application to retrieve and process attacker-controlled content from an external source. This enables execution of arbitrary commands on the underlying host, with high impact on all three CIA dimensions and a changed scope extending beyond the vulnerable component. No workaround is available. Remediation requires applying the referenced Support Package patches and subsequently enabling the newly introduced “Secure Transformer” system property with an explicit allow-list of permitted XSL hosting sources.
- Memory Corruption in ABAP Kernel – DIAG Protocol Parsing (Note 3714806, CVSS 9.8): An unauthenticated attacker can exploit logical errors in the DIAG protocol parsing logic within the SAP NetWeaver ABAP kernel, causing memory corruption that may disclose sensitive system information or crash the application server. The vulnerability affects kernel versions spanning 7.22 through 9.19, making it broadly applicable across on-premise landscapes. No workaround exists. The correction is delivered via kernel patch (hotfix DW.SAR or SP Stack Kernel SAPEXE.SAR/SAPEXEDB.SAR); customers must apply the latest available SP Stack Kernel containing the fix and review the associated regression note before deployment.
- Code Injection via SSTI in SAP MII – IllumXSLTServlet (Note 3758900, CVSS 9.1): An attacker holding high-privileged access to the XMII_IllumXSLTServlet action can submit crafted input processed without sufficient validation, enabling arbitrary command execution on the operating system. The vulnerable servlet component is removed entirely in the fix; any custom implementation relying on it must migrate to the XSL Transform action block. A temporary workaround is to revoke the XMII_IllumXSLTServlet action from all roles, as no pre-shipped MII role includes this assignment. Permanent remediation requires the referenced Support Package patches for XMII 15.4/15.5.
Critical Priority (CVSS 7.0 - 8.9)
- Privilege Escalation in SAP ABAP Developer Tools – SQL Console (Note 3772411, CVSS 8.8): A low-privileged attacker can exploit the SQL Console’s support for host expressions within SQL statements to execute unauthorized database operations against SAP NetWeaver AS ABAP, enabling data exfiltration, modification, and disruption of legitimate user access. The vulnerability bypasses the intended scope of the SQL Console and violates access control principles. A temporary mitigation is to ensure authorization objects S_TABU_NAM and S_TABU_DIS are not assigned to any user. Permanent fix requires applying the referenced Support Packages across SAP_BASIS 750 through 920.
- Buffer Overflow in SAP Commerce Cloud via NGINX (Note 3773203, CVSS 8.1): An unauthenticated attacker can send specially crafted requests that trigger memory corruption in an internal NGINX process used by SAP Commerce Cloud JavaScript Storefronts. Exploitation depends on conditions outside the attacker’s control and on systems where standard memory protections are bypassed, but successful exploitation leads to arbitrary code execution. No workaround is available. The patch is present in all Public Cloud systems; customers must create a new build and deploy to consume the patched components (available since 2026-06-03 in release 2610-5).
- Credentials Disclosure in SAP BusinessObjects BI Platform – CMS (Note 3756565, CVSS 7.9): An attacker with high privileges and local server access can retrieve user objects and decrypt stored credentials protected by a hard-coded cryptographic key, obtaining sensitive authentication data and modifying protected information. The attack vector is local with low complexity. No workaround exists. Remediation requires applying the referenced patches and, for systems with pre-existing secondary credentials, following the key rotation procedure documented in KBA 3763536.
- RCE via Insecure Deserialization in CTS+ Attach Tool (Note 3773304, CVSS 7.6): An authenticated attacker can supply a specially crafted MTA archive file that, when processed by the ctsattach tool’s third-party library, triggers insecure deserialization leading to remote code execution. All installed versions (1.0.0 through 1.2.0) are affected with no unaffected release. SAP mandates immediate cessation of use and complete removal of the tool from all systems, as it is no longer available under the SAP Developer License Agreement 3.2. No patch exists; deletion is the sole remediation.
- Directory Traversal in SAP MII – SSCE Functionality (Note 3759854, CVSS 7.6): A privileged attacker can exploit insufficient file path validation in SSCE functionality to write files outside the intended directory, affecting other components. Exploitation requires a legitimate user to subsequently access the attacker-influenced content. A temporary workaround is to restrict the XMII_Developer role and apply SAP Note 3158613 to prevent injection attacks. Permanent fix requires the referenced Support Package patches.
- Missing Authorization Check in SAP MII – Scheduling Functions (Note 3758657, CVSS 7.3): An unauthenticated remote attacker can access scheduling-related application functions without proper authorization validation, enabling retrieval, creation, modification, or deletion of application-managed scheduling data. The attack vector is network-based with low complexity and no required privileges. No workaround is available. The fix enforces additional role assignments on the affected configuration page; apply the referenced Support Package patches.
- Missing Authorization Check in SAP MII – Cost Servlet (Note 3758910, CVSS 7.3): An unauthenticated attacker can send crafted requests to the Cost Servlet using specific parameter values to access backend operations, enabling read, create, modify, or delete of application-managed business data. The attack requires no user interaction and no prior authentication. No workaround is available. The fix requires additional roles and authorizations for users accessing the affected configuration screen; apply the referenced Support Package patches.
- Multiple Vulnerabilities in SAP Business AI Platform – Approuter (Note 3786038, CVSS 7.0): This consolidated note addresses eleven distinct CVEs in the SAP Approuter component, including information disclosure via token validation bypass, improper certificate validation, missing authorization checks on WebSocket and request forwarding flows, HTTP request smuggling, cross-site request forgery, identity spoofing, and multiple denial-of-service vectors. The highest-impact issue (CVE-2026-58230) allows an unauthenticated attacker to cause sensitive credential material to be sent to an attacker-controlled destination under IAS-based authentication without x509 certificates. Remediation requires upgrading the @sap/approuter Node.js package to version 23.0.0 or above. Targeted workarounds include binding IAS with x509 credentials and setting STATE_PARAMETER_SECRET to true.
Key Affected Components
SAP NetWeaver AS ABAP / ABAP Platform (Kernel & Basis): Notes 3714806 (kernel memory corruption, CVSS 9.8), 3745182 (OS command injection in kernel, CVSS 5.5), 3756674 (dispatcher memory disclosure, CVSS 5.3), 3721424 (XSS in Unified Rendering, CVSS 6.3), 3752864 (CTS authorization bypass, CVSS 4.2), and 3772411 (ABAP Developer Tools privilege escalation, CVSS 8.8) collectively impact the foundational ABAP runtime, kernel, and transport infrastructure across SAP_BASIS 740–920 and kernel releases 7.22–9.19.
SAP Manufacturing Integration and Intelligence (MII 15.4/15.5): Notes 3765948 (SSRF/code injection, CVSS 9.9), 3758900 (SSTI/code injection, CVSS 9.1), 3759854 (directory traversal, CVSS 7.6), 3758657 (missing auth – scheduling, CVSS 7.3), 3758910 (missing auth – Cost Servlet, CVSS 7.3), and 3781137 (missing auth – user info, CVSS 4.3) represent a concentrated cluster of six vulnerabilities indicating systemic input-validation and authorization deficiencies in the MII application layer.
SAP Commerce Cloud / Data Hub (Public Cloud 2211, 2211-JDK21): Notes 3771065 (Data Hub Adapter RCE, CVSS 10.0), 3773203 (NGINX buffer overflow, CVSS 8.1), 3757815 (Bouncy Castle timing attack, CVSS 6.5), 3778462 (Netty DoS, CVSS 4.8), and 3770868 (Apache Log4j Core output encoding, CVSS 6.5) expose the commerce platform to both application-level and third-party library threats requiring coordinated patch and rebuild cycles.
SAP BusinessObjects Business Intelligence Platform (4.3, 2025, 2027): Notes 3756565 (CMS credentials disclosure, CVSS 7.9), 3753141 (Web Intelligence XXE, CVSS 6.5), and 3770649 (Admin Tools authorization bypass, CVSS 4.3) affect the BI reporting, management, and administrative layers.
SAP Business AI Platform / Approuter (<23.0.0): Note 3786038 consolidates eleven CVEs spanning authentication, authorization, certificate validation, request smuggling, and DoS vectors in the cloud application routing layer.
SAP S/4HANA Core (S4CORE 102–109): Notes 3669608 (bank statement authorization bypass, CVSS 4.3), 3766473 (SQL injection in Social Intelligence, CVSS 6.3), 3540688 (FICA ODN code injection, CVSS 5.5), and 3763028 (APO hard-coded credentials, CVSS 3.8) impact financial, supply chain, and cross-application modules.
SAPUI5 / Unified Rendering (SAP_UI 750–816): Notes 3772071 (stored XSS via UI5 Flexibility, CVSS 6.1) and 3721424 (DOM-XSS in Unified Rendering, CVSS 6.3) affect the front-end rendering stack.
SAP NetWeaver AS Java / Adobe Document Services (ADSSAP 7.50): Note 3758318 (vulnerable OpenSSL and libcurl, CVSS 6.3) requires library-level updates within the ADS component.
SAP Data Services Management Console (4.3, 2025): Note 3739913 (CSP misconfiguration, CVSS 3.7) affects the EIM data integration management interface.
SAPSPrint Service (8.00, 8.10 – Windows): Note 3725940 (unauthenticated buffer overflow/DoS, CVSS 5.3) impacts the server-based printing service.
pyodata Python Library (<1.11.2 – pip): GHSA-hc5j-q32w-c25v (CVE-2026-66773, CVSS 5.9) addresses improper cross-origin validation of __next URLs; no SAP product is directly impacted, but custom integrations using pyodata are affected.
Notable Trends
1 – Concentrated Application-Layer Injection in SAP MII
Six of the thirty-one entries this cycle target SAP Manufacturing Integration and Intelligence, representing nearly 20% of the entire release. The vulnerability cluster—spanning SSRF-driven code injection (3765948), server-side template injection (3758900), directory traversal (3759854), and three distinct missing authorization checks (3758657, 3758910, 3781137)—indicates a systemic deficiency in input sanitization, path validation, and access-control enforcement across the MII 15.4/15.5 codebase. The presence of two Critical-rated code injection vectors (CVSS 9.9 and 9.1) alongside multiple unauthenticated authorization bypasses suggests that MII’s servlet-based architecture and XSL transformation pipeline have not been adequately hardened against modern injection techniques. Organizations running MII in production should treat this as a single, coordinated remediation campaign rather than discrete patch applications, as the shared Support Package patches (XMII 15.4 SP001 PL 000057; XMII 15.5 SP002 PL 000010) address multiple CVEs simultaneously.
2 – Third-Party and Open-Source Component Exposure in Cloud-Delivered Products
Five vulnerabilities in SAP Commerce Cloud and Data Hub (Notes 3771065, 3773203, 3757815, 3778462, 3770868) and one in SAP NetWeaver AS Java (Note 3758318) are directly attributable to embedded open-source libraries: NGINX, Bouncy Castle, Netty, Apache Log4j Core, OpenSSL, and libcurl. This pattern reflects a broader industry trend where SAP’s cloud and on-premise products inherit risk from their dependency ecosystems. The Commerce Cloud entries are particularly notable because remediation requires a full build-and-deploy cycle rather than a simple patch install, introducing operational friction that may delay adoption. The Bouncy Castle timing-attack vector (CVE-2026-5598) and the Netty HTTP/2 DoS (CVE-2026-33871) further illustrate that even “medium” severity third-party issues can compound when layered across multiple components in a single deployment. Organizations should maintain a continuous dependency-scanning pipeline for SAP cloud applications to detect upstream CVEs before they propagate into SAP’s release cycle.
3 – Kernel-Level Memory Safety and Unauthenticated Attack Surface
The ABAP Platform kernel is affected by three distinct memory-safety vulnerabilities: DIAG protocol parsing corruption (3714806, CVSS 9.8), OS command injection (3745182, CVSS 5.5), and dispatcher uninitialized memory disclosure (3756674, CVSS 5.3). All three are exploitable by unauthenticated, remote attackers over the network with low complexity, and none offer a workaround. The breadth of affected kernel versions (7.22 through 9.19) means that virtually every on-premise NetWeaver ABAP system is in scope. The absence of any compensating control or network-level mitigation elevates the urgency: these are not application-layer issues that can be mitigated through WAF rules or authorization hardening, but fundamental memory-safety defects in the runtime that require kernel-level patching. The 9.8-rated DIAG vulnerability, in particular, warrants immediate attention as it represents a potential remote code execution vector against the most critical layer of the SAP stack.
The botton line
The August 2026 release demands a prioritized, risk-tiered response across all production and non-production environments:
- Immediate Kernel Patching (Notes 3714806, 3745182, 3756674): Apply the latest SP Stack Kernel or hotfix (DW.SAR) containing the DIAG protocol parsing correction to all SAP NetWeaver AS ABAP and ABAP Platform systems within 48 hours. Verify the target patch level against SAP Note 2083594, review the regression note (SAP Note 1802333), and schedule a controlled maintenance window. No workaround exists for any of the three kernel vulnerabilities; unpatched systems are exposed to unauthenticated remote exploitation.
- SAP MII Coordinated Remediation (Notes 3765948, 3758900, 3759854, 3758657, 3758910, 3781137): Deploy the cumulative Support Package patches (XMII 15.4 SP001 PL 000057 / XMII 15.5 SP002 PL 000010) and immediately enable the “Secure Transformer” system property with an explicit XSL host allow-list. Revoke the XMII_IllumXSLTServlet action from all roles and audit custom integrations for dependency on the removed servlet. Apply Note 3158613 as a supplementary hardening measure against directory traversal injection.
- SAP Commerce Cloud Rebuild & Deploy (Notes 3771065, 3773203, 3757815, 3778462, 3770868): Apply Update Release 2211-jdk21.17 (or 2211.55) to remediate the Data Hub Adapter RCE, then rebuild and redeploy all Public Cloud environments. As an interim measure, configure the IP Filter Set to restrict /datahubadapter/import/** to known DataHub egress IPs. Validate that Bouncy Castle, Netty, and Log4j Core library versions meet the patched baselines post-deployment.
- CTS+ Attach Tool Removal (Note 3773304): Immediately identify and delete all installations of the ctsattach tool (versions 1.0.0 through 1.2.0) from developer workstations, build servers, and CI/CD pipelines. The tool is permanently discontinued; no patch or safe version exists. Audit transport workflows for alternative MTA attachment mechanisms.
- Approuter Upgrade (Note 3786038): Upgrade the @sap/approuter Node.js package to version 23.0.0 or above in all SAP Business AI Platform and Cloud Application Programming Model deployments. Verify XSUAA redirect-URI scoping per Note 3741519 and bind IAS authentication with x509 credentials where applicable.
- BI Platform and S/4HANA Patches (Notes 3756565, 3753141, 3770649, 3669608, 3766473, 3540688, 3763028): Apply the referenced Support Packages for BusinessObjects BI Platform (4.3 SP005 PL 000700 / 2025 SP000 PL 001200) and S/4HANA core (SAPK-10219INS4CORE through SAPK-10902INS4CORE) within the standard monthly patch cycle. For Note 3669608, ensure follow-up Notes 3775098 and 3790190 are applied for complete authorization enforcement.
Failure to address the Critical and High priority items within the recommended window leaves SAP landscapes exposed to unauthenticated remote code execution, credential theft, and data exfiltration across the ABAP kernel, MII, Commerce Cloud, and BI Platform layers. The convergence of kernel-level memory corruption with application-layer injection vectors in a single release cycle represents a compounded threat that no single compensating control can mitigate; only full, coordinated patching across all affected tiers restores the intended security posture.
At Vicxer, our SAP security experts streamline vulnerability management with real-time monitoring and tailored remediation strategies. Safeguard your landscape against evolving threats. Contact us today to fortify your SAP environment.