Critical SAP Vulnerabilities Allow Code Injection, Memory Corruption

Key Takeaways

• SAP’s August 2026 Security Patch Day addresses 28 new vulnerabilities, including several critical flaws.
• Impacted systems include SAP Commerce Cloud, SAP NetWeaver, ABAP Platform, and SAP Manufacturing Integration and Intelligence.
• Critical vulnerabilities, some with a CVSS score of 10.0, could enable unauthenticated code injection, memory corruption, and privilege escalation.
• Immediate patching is strongly recommended for all affected enterprise SAP deployments due to the severity and potential for remote exploitation.

SAP Unveils Critical Patches Addressing Major Vulnerabilities in Core Business Platforms

SAP has released its August 2026 Security Patch Day, a significant update package that delivers fixes for 28 new security notes, alongside one GitHub security advisory and two updates to previously issued notes. The patches, made available on August 11, 2026, target several critical-severity flaws that could allow unauthenticated attackers to execute malicious code, corrupt system memory, and escalate privileges across widely used enterprise platforms.

Given the pervasive reliance of global enterprises on SAP systems for critical functions like enterprise resource planning, finance, supply chain management, and commerce, cybersecurity teams are urged to prioritize the immediate deployment of these updates.

Severe Vulnerabilities Threaten Core SAP Operations

Among the most pressing issues addressed this month is an improper authorization vulnerability in the Data Hub Adapter component of SAP Commerce Cloud. Identified as CVE-2026-58231, this flaw has been assigned a maximum CVSS score of 10.0. It specifically affects COM_CLOUD versions 2211 and 2211-JDK21. The highest severity rating indicates that exploiting this vulnerability requires no prior authentication or user interaction, potentially granting remote attackers full control over the confidentiality, integrity, and availability of affected systems.

Another critical vulnerability involves a code injection flaw within SAP Manufacturing Integration and Intelligence. Tracked as CVE-2026-44772, this issue holds a CVSS score of 9.9. Successful exploitation of this vulnerability, which impacts XMII and MII_ADMIN versions 15.4 and 15.5, could allow adversaries to execute arbitrary code within essential manufacturing software environments. A related code injection vulnerability in the same component, CVE-2026-44758, also rates as critical with a CVSS score of 9.1.

Memory Corruption Risks and Broader Impacts

Memory corruption vulnerabilities are also a significant concern in this patch cycle. CVE-2026-34265, with a CVSS score of 9.8, addresses a severe memory corruption flaw affecting the Application Server ABAP component within SAP NetWeaver and the ABAP Platform. This vulnerability impacts a broad spectrum of kernel versions, from 7.22 up to the more recent 9.19 releases.

Memory corruption flaws in foundational application servers are particularly dangerous because they can be weaponized by attackers to achieve remote code execution, providing initial access that can then be used to pivot and move laterally across corporate networks. Organizations must apply these critical SAP patches promptly to prevent threat actors from developing and deploying reliable exploit chains.

As detailed in the official SAP August 2026 Security Patch Day advisory, enterprise systems are under constant threat from sophisticated cyberattack groups. Applying these security updates is crucial to prevent adversaries from exploiting unpatched infrastructure or leveraging vulnerabilities like SQL injection against critical business databases.

Beyond the critical-rated bugs, several high-severity issues also necessitate immediate attention:

• Privilege Escalation (CVE-2026-58243): This vulnerability, scoring 8.8, affects a wide array of SAP_BASIS versions within SAP ABAP Developer Tools.
• Public-Cloud Buffer Overflow (CVE-2026-42945): With a CVSS score of 8.1, this flaw impacts SAP Commerce Cloud environments that utilize NGINX in public-cloud configurations.
• CTS Attach Tool RCE (CVE-2026-58233): SAP has provided updated guidance for a remote code execution vulnerability in the Change and Transport System Attach Tool (ctsattach), which was initially disclosed in July 2026.
• Additional High-Severity Notes: These include vulnerabilities leading to credential disclosure in the SAP BusinessObjects Business Intelligence Platform, as well as directory traversal and missing authorization checks in Manufacturing Integration and Intelligence.

The remaining medium and low-severity notes address a diverse range of flaws across various SAP modules. These encompass cross-site scripting (XSS) vulnerabilities in SAPUI5 and NetWeaver Application Server ABAP, SQL injection in SAP Social Intelligence, XML External Entity (XXE) injection in BusinessObjects, a vulnerability in the pyodata Python library (GHSA-hc5j-q32w-c25v), and an information disclosure issue in the Bouncy Castle Java library used by Commerce Cloud.

Considering the extensive range of affected products, including NetWeaver, ABAP Platform, Commerce Cloud, BusinessObjects, and Manufacturing Integration and Intelligence, security administrators must prioritize applying these SAP security updates without delay.

What You Should Do

• Identify Exposed Instances: Conduct a comprehensive inventory of all public-facing and internal SAP deployments running Commerce Cloud, NetWeaver, or Manufacturing Integration and Intelligence.
• Prioritize Critical Notes: Immediately apply patches for CVE-2026-58231, CVE-2026-44772, and CVE-2026-34265, treating this as an emergency maintenance task.
• Audit Developer Tools: Ensure all SAP_BASIS modules are updated to mitigate privilege escalation risks in developer environments.
• Verify Third-Party Libraries: Confirm that underlying dependencies, such as the pyodata Python package and the Bouncy Castle Java library, are updated across all custom application extensions.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.