SAP: Twelve Vulnerabilities Disclosed Together on June 9, 2026
Key findings • Twelve SAP vulnerabilities disclosed simultaneously on June 9, 2026. • Critical flaws include memory corruption, unauthorized data access, and path traversal. • Vulnerabili…
Key findings
- Twelve SAP vulnerabilities disclosed simultaneously on June 9, 2026.
- Critical flaws include memory corruption, unauthorized data access, and path traversal.
- Vulnerabilities affect core SAP products like NetWeaver, ABAP Platform, and Business Objects.
- Issues range from privilege escalation and SQL injection to XSS and email spoofing.
- SAP has released patches; prompt application is crucial for mitigation.
On June 9, 2026, SAP disclosed a batch of twelve security vulnerabilities affecting various components of its enterprise software. The disclosures, all published on the same day, range in severity from low to critical, impacting products such as SAP NetWeaver, ABAP Platform, Business Objects, and S/4HANA.
Several critical vulnerabilities were highlighted in the disclosures. CVE-2026-44748, a critical flaw in SAP NetWeaver Application Server ABAP and ABAP Platform, allows an authenticated attacker to tamper with signed XML documents, potentially leading to unauthorized access to sensitive user data. Another critical vulnerability, CVE-2026-27671, affects the SAP Kernel used by Application Server ABAP and ABAP Platform. This flaw, stemming from improper RFC protocol validation, can lead to memory corruption and significant impacts on confidentiality. Additionally, CVE-2026-40128, a critical vulnerability in SAP NetWeaver Application Server Java (Web Container), enables an unauthenticated attacker to perform path traversal and potentially view or modify sensitive information by manipulating file inclusion parameters in HTTP logon requests.
Other notable vulnerabilities include a high-severity privilege escalation flaw, CVE-2026-44751, in Application Server ABAP, where an authenticated user can overwrite another user's information. Medium-severity issues were also prevalent, such as CVE-2026-44757, a cross-site scripting (XSS) vulnerability in SAP Wily Introscope Enterprise Manager, and CVE-2026-44746, a reflected XSS vulnerability in SAP NetWeaver JAVA's JDBC Test Servlet. SAP Business Objects Business Intelligence Platform is affected by CVE-2026-44755, an email spoofing vulnerability, and SAP S/4HANA contains CVE-2026-44744, an SQL injection vulnerability.
Further medium-severity issues include privilege escalation in SAP MDG (CVE-2026-44750) and arbitrary service calls in SAP Fiori Launchpad (CVE-2026-24315), which could lead to credential theft. The Operational Data Provisioning Data Replication API (ODP-RFC) has a missing caller identification vulnerability (CVE-2026-44754). A low-severity information leak vulnerability was also disclosed for SAP Business Objects (CVE-2026-44743).
SAP has provided patches and updates to address these vulnerabilities. Customers are strongly advised to consult SAP's security notes and apply the relevant updates to mitigate the risks associated with these disclosures. The comprehensive nature of this batch underscores the importance of regular security patching and diligent review of SAP security advisories.
SAP's June 2026 Security Patch Day has been released, addressing a total of 15 vulnerabilities across its product suite. This update includes four critical-severity flaws, notably CVE-2026-44748 (CVSS 9.9) in SAP NetWeaver's SAML Authentication, which allows for privilege escalation, and CVE-2026-27671 (CVSS 9.8) in Application Server ABAP's kernel, enabling unauthenticated memory corruption. Additionally, CVE-2026-22732 (CVSS 9.1) impacts SAP Commerce Cloud, and CVE-2026-40128 (CVSS 9.0) affects SAP NetWeaver Java's Web Container, with patches urgently recommended for all.
This new report from SecurityWeek details critical vulnerabilities affecting SAP's NetWeaver and Commerce platforms, specifically highlighting the potential for sensitive information disclosure, memory corruption, and disruption of normal system operations. Organizations are urged to apply the provided patches promptly to mitigate these newly disclosed risks.
SAP has released patches for 15 vulnerabilities, including four critical flaws affecting SAP NetWeaver and SAP Commerce Cloud. Among these are CVE-2026-44748, an XML Signature Wrapping flaw enabling authentication bypass, and CVE-2026-27671, a memory corruption vulnerability in NetWeaver/ABAP Platform. Additionally, a Spring Security-related vulnerability (CVE-2026-22732) impacts SAP Commerce Cloud and SAP Data Hub, while CVE-2026-40128 is a directory traversal in NetWeaver.