SAP Security Patch Day –January 2026
On January 13, 2026, SAP released its first Security Patch Day of the year with 17 new Security Notes, representing a significant escalation from December’s 14 notes and marking a concerning start to 2026.
This release features 4 Critical-severity vulnerabilities with CVSS scores ranging from 9.1 to 9.9, 5 High-severity issues (CVSS 8.1–8.8), 6 Medium-severity problems (CVSS 4.3–6.4), and 2 Low-severity vulnerabilities (CVSS 3.0–3.8).
Unlike December, no updates to previous notes were released, indicating fresh vulnerabilities rather than iterative refinements. The focus intensifies on injection attacks (SQL and code injection), privilege escalation, and authorization bypass across enterprise core systems.
Key Highlights by Severity
Critical Priority (CVSS 9.9)
A SQL injection vulnerability in S/4HANA Financials General Ledger (Note 3687749, version 18) allows authenticated attackers with low privilege to execute crafted SQL queries against backend databases, reading, modifying, and deleting data with full impact on confidentiality, integrity, and availability. The vulnerability depends on incorrect SRFC authorization object configuration, placing responsibility on both SAP and customer access control implementation.
Critical Priority (CVSS 9.6)
A remote code execution flaw in SAP Wily Introscope Enterprise Manager WorkStation (Note 3668679, version 26) enables unauthenticated attackers to craft malicious JNLP (Java Network Launch Protocol) files, executing arbitrary commands when victims click URLs or launch the application, compromising confidentiality, integrity, and availability completely. The fix updates JNLP generation with proper parameter validation and requires upgrade to version 10.8 SP01 Patch 2.
Critical Priority (CVSS 9.1 - two notes)
Code injection in S/4HANA (Note 3694242, version 3) targets RFC-exposed function modules accessible by admin-privilege users, enabling arbitrary ABAP/OS command injection as a backdoor to full system compromise.
Code injection in SAP Landscape Transformation (Note 3697979, version 5) mirrors the S/4HANA flaw across DMIS versions, enabling similar RFC-based admin-privilege exploits leading to complete system control.
High Priority (CVSS 8.8 - 8.1)
- Privilege escalation in SAP HANA database (Note 3691059, version 7, CVSS 8.8): Any authenticated user can impersonate other users, potentially gaining admin access; fixed in SPS07 revision 79.07 and SPS08 revision 88.
- OS command injection in AS ABAP and NetWeaver RFC SDK (Note 3675151, version 10, CVSS 8.4): Authenticated admin users can upload crafted content enabling arbitrary OS command execution via rfcExec validation flaws.
- Multiple vulnerabilities in Fiori Intercompany Balance Reconciliation (Note 3565506, version 15, CVSS 8.1): Missing authorization, unrestricted file upload, and email misconfiguration enable privilege escalation and phishing.
- Missing authorization in NetWeaver AS ABAP (Note 3688703, version 5, CVSS 8.1): RFC functions allow execution of FORM routines without checks, enabling data modification and system function invocation across SAPBASIS 700–816.
Key Affected Components
SAP S/4HANA (Core & Finance): Three critical/high notes affect Financials GL (SQL injection, code injection) and Intercompany Balance Reconciliation (Fiori, authorization gaps, file upload), concentrating the highest-impact vulnerabilities in enterprise financials and reporting.
SAP NetWeaver (ABAP, Java, Portal): Five notes across AS ABAP, Enterprise Portal, Internet Communication Framework, and RFC SDK address missing authorizations, XSS, and OS command injection, highlighting systemic weaknesses in core application server components spanning 15+ SAPBASIS versions.
SAP HANA Database: One High-severity privilege escalation (version 2.00) undermines database-level identity management, allowing lateral privilege escalation within the data tier itself.
SAP Wily Introscope & Monitoring: One Critical RCE in WorkStation via JNLP protocol shows monitoring tools as high-value attack vectors unauthenticated, with broad impact despite single-product scope.
SAP Landscape Transformation, Identity Management, Business Connector, SRM: Six additional notes span data transformation, identity/JNDI injection, XSS in connectors/portals, and open redirect in SRM catalogs, indicating broad ecosystem exposure beyond core ERP.
Notable Trends
1- SQL Injection Returns as Critical Vector
The S/4HANA Financials GL SQL injection (CVSS 9.9) marks a resurgence of database-level threats after months dominated by code injection in ABAP logic. Combined with Landscape Transformation code injection, this combination exposes data access and transformation pipelines as high-value, often-overlooked entry points for attackers.
2 – Code Injection Parallel Across Platforms
Two identical CVSS 9.1 code injection vulnerabilities (S/4HANA and LT) within the same patch day suggest a shared underlying design flaw in RFC-exposed function modules, likely indicating a systemic pattern across older function groups that were never intended for external RFC access.
3 – Admin-Privilege Gateway to Full Control
Several High-severity notes (Fiori, NetWeaver RFC, HANA privilege escalation) show that high-privilege users who typically have legitimate access to sensitive areas can escalate or misuse that access when authorization checks are missing or weak. This pattern emphasizes the danger of overly broad admin roles and the need for role segregation.
4 – Unintended Protocol and File Handling
Wily Introscope’s JNLP flaw and SRM’s open redirect both relate to protocol/redirect handling that was never security-hardened because it operated in perceived trusted contexts. As remote and cloud deployments blur these boundaries, such “trust by design” assumptions become liabilities.
5 – Fiori App Cluster of Multiple Vectors
The Intercompany Balance Reconciliation app exhibits authorization gaps, file upload, and email spoofing in a single note (3565506), a symptom of inadequate security review during UI framework migrations to Fiori.
6 – No Iterative Updates This Month
Unlike December’s Solution Manager update or November’s deserialization hardening refinements, January brings no follow-up notes, suggesting these are freshly discovered vulnerabilities rather than edge cases to prior patches, heightening urgency.
The botton line
January 2026’s release demands urgent, coordinated organizational response across all SAP environments:
- Emergency Patching Required for all four Critical vulnerabilities: S/4HANA Financials GL SQL injection (Note 3687749), Wily Introscope RCE (Note 3668679), S/4HANA code injection (Note 3694242), and Landscape Transformation code injection (Note 3697979), prioritizing based on affected system criticality.
- Authorization Architecture Overhaul for SRFC object configuration in S/4HANA Financials, NetWeaver RFC function exposure, and Fiori Intercompany Balance Reconciliation to prevent RFC-based and role-based exploits.
- HANA Privilege Escalation Review requiring immediate SPS07/SPS08 updates and verification of user identity management across all connected systems.
- Wily Introscope Immediate Upgrade to version 10.8 SP01 Patch 2 or migration to standalone workstation deployment to eliminate JNLP-based RCE vectors.
- Fiori App Security Audit covering authorization checks, file upload restrictions, and email handling in all deployed Fiori applications, especially reconciliation and workflow-intensive modules.
- NetWeaver Basis Hardening across SAPBASIS 700–816 to disable RFC FORM execution functions and apply missing authorization checks across all ABAP platform versions.
- Configuration Baseline Verification for JNDI, encryption algorithms, and redirect URL validation across Identity Management, NetWeaver Java UME, and SRM platforms.
This month’s concentration of fresh, untouched critical vulnerabilities with no iterative refinements signals a high-threat quarter ahead. Organizations must assume that additional vulnerabilities in the same or related areas will surface in February’s Patch Day and plan remediation sequencing accordingly.
The overlap of SQL injection, code injection, and privilege escalation across multiple tiers (database, application, messaging) creates a perfect storm for lateral movement and data exfiltration. Defenders must treat these as interconnected rather than isolated patches and implement compensating controls, such as enhanced logging, network segmentation, activity monitoring, while patches roll out.
At Vicxer, our SAP security experts streamline vulnerability management with real-time monitoring and tailored remediation strategies. Safeguard your landscape against evolving threats. Contact us today to fortify your SAP environment.