cyber.hendryadrian.com
Security News · securityweek.com

SAP Patches Critical Authentication, Code Injection and Memory Corruption Flaws

· Original article ↗

Summary

SAP released 28 security notes for August 2026, including fixes for critical flaws that could enable authentication bypass, command execution, information disclosure or system crashes. SAP did not report in-the-wild exploitation.

Key points

  • SAP announced 28 new security notes, updates to two prior notes and a GitHub advisory for August 2026.
  • CVE-2026-58231, rated CVSS 10.0, affects SAP Commerce Cloud Data Hub Adapter; remote attackers could bypass authentication and potentially execute code.
  • Two critical flaws in Manufacturing Integration and Intelligence, CVE-2026-44772 and CVE-2026-44758, could allow arbitrary command execution; one requires higher privileges.
  • CVE-2026-34265 affects Application Server ABAP for NetWeaver and ABAP Platform; unauthenticated exploitation could disclose sensitive information or crash the system.
  • SAP said it was not aware of any of the flaws being exploited in the wild.

Article Details

Event Type
SAP security patch release
Impact
SAP released 28 new security notes, updates to two previous notes, and a GitHub advisory. Four notes address critical vulnerabilities: CVE-2026-58231 could permit authentication bypass and potentially code execution and unauthorized access; CVE-2026-44772 and CVE-2026-44758 could enable arbitrary command execution and infrastructure compromise; and CVE-2026-34265 could allow sensitive information disclosure or system crashes. The article reports no mention of the flaws being exploited in the wild.

CVE

CVE-2026-34265Vendor / Product unavailableThe fourth critical defect is CVE-2026-34265 (CVSS score of 9.8/10), which is described as a memory corruption issue in Application Server ABAP for NetWeaver and ABAP Platform.CVE-2026-44758Vendor / Product unavailableSAP also addressed two critical code injection flaws in Manufacturing Integration and Intelligence, tracked as CVE-2026-44772 (CVSS score of 9.9/10) and CVE-2026-44758 (CVSS score of 9.1/10).CVE-2026-44772Vendor / Product unavailableSAP also addressed two critical code injection flaws in Manufacturing Integration and Intelligence, tracked as CVE-2026-44772 (CVSS score of 9.9/10) and CVE-2026-44758 (CVSS score of 9.1/10).CVE-2026-58231SAP_SE · SAP Commerce Cloud (Data Hub Adapter)on SAP’s August 2026 Security Patch Day resolve critical vulnerabilities, the most severe of which is CVE-2026-58231 (CVSS score of 10/10), an improper authorization issue in SAP Commerce Cloud (Data Hub Adapter).

Vendors

SAPEnterprise software maker SAP on Tuesday announced the release of 28 new security notes, two updates to previous notes, and a GitHub advisory.

Products

ABAP Developer ToolsOn Tuesday, SAP also released eight notes dealing with high-severity flaws in ABAP Developer Tools, Commerce Cloud, Change and Transport System Attach Tool, BusinessObjects, Manufacturing Integration and Intelligence,ABAP PlatformThe fourth critical defect is CVE-2026-34265 (CVSS score of 9.8/10), which is described as a memory corruption issue in Application Server ABAP for NetWeaver and ABAP Platform.Application Server ABAP for NetWeaverThe fourth critical defect is CVE-2026-34265 (CVSS score of 9.8/10), which is described as a memory corruption issue in Application Server ABAP for NetWeaver and ABAP Platform.Business AI Platform (Approuter)System Attach Tool, BusinessObjects, Manufacturing Integration and Intelligence, and Business AI Platform (Approuter).BusinessObjectsflaws in ABAP Developer Tools, Commerce Cloud, Change and Transport System Attach Tool, BusinessObjects, Manufacturing Integration and Intelligence, and Business AI Platform (Approuter).Change and Transport System Attach Tooleight notes dealing with high-severity flaws in ABAP Developer Tools, Commerce Cloud, Change and Transport System Attach Tool, BusinessObjects, Manufacturing Integration and Intelligence, and Business AI PlatformNetWeaver Application Server ABAPBefore this month’s patches, SAP updated a critical security note released on the July 2026 Patch Day to resolve a critical memory corruption bug in NetWeaver Application Server ABAP.SAP Commerce Cloudmost severe of which is CVE-2026-58231 (CVSS score of 10/10), an improper authorization issue in SAP Commerce Cloud (Data Hub Adapter).SAP Commerce Cloud (Data Hub Adapter)of which is CVE-2026-58231 (CVSS score of 10/10), an improper authorization issue in SAP Commerce Cloud (Data Hub Adapter).SAP Manufacturing Integration and IntelligenceSAP also addressed two critical code injection flaws in Manufacturing Integration and Intelligence, tracked as CVE-2026-44772 (CVSS score of 9.9/10) and CVE-2026-44758 (CVSS score of 9.1/10).

Related Articles