SAP Patches Critical Code Injection, Memory Corruption Vulnerabilities
SAP released 28 new and two updated security notes in August 2026, addressing multiple vulnerabilities including four critical-severity bugs. These critical issues include a remote code execution vulnerability in SAP Commerce Cloud, two critical code injection flaws in Manufacturing Integration and Intelligence, and a memory corruption vulnerability in Application Server ABAP for NetWeaver and ABAP Platform. The vulnerabilities could allow unauthorized access, code execution, information disclosure, and system crashes. SAP has provided patches for these vulnerabilities as part of their August 2026 Security Patch Day. There are no reports of exploitation in the wild at this time.
AI Analysis
Technical Summary
SAP's August 2026 Security Patch Day included 28 new and two updated security notes addressing multiple vulnerabilities. Four critical vulnerabilities were highlighted: CVE-2026-58231 (CVSS 10.0) in SAP Commerce Cloud allows remote attackers to bypass authentication and potentially execute code; CVE-2026-44772 (CVSS 9.9) and CVE-2026-44758 (CVSS 9.1) are critical code injection flaws in Manufacturing Integration and Intelligence that enable arbitrary command execution; and CVE-2026-34265 (CVSS 9.8) is a memory corruption issue in Application Server ABAP that can be exploited without authentication to disclose sensitive information or crash the system. Additional high-severity and medium/low-severity vulnerabilities were also addressed. SAP has released official patches for these issues.
Potential Impact
Successful exploitation of these vulnerabilities could lead to unauthorized access, remote code execution, disclosure of sensitive information, system crashes, and total infrastructure compromise. The critical vulnerabilities affect confidentiality, integrity, and availability of affected SAP applications and infrastructure. No active exploitation in the wild has been reported.
Mitigation Recommendations
SAP has released official patches for all identified vulnerabilities as part of the August 2026 Security Patch Day. Organizations using affected SAP products should apply these patches promptly to remediate the critical code injection, memory corruption, and other security issues. There are no indications that these vulnerabilities are currently exploited in the wild, but timely patching is strongly recommended.
SAP Patches Critical Code Injection, Memory Corruption Vulnerabilities
Description
SAP released 28 new and two updated security notes in August 2026, addressing multiple vulnerabilities including four critical-severity bugs. These critical issues include a remote code execution vulnerability in SAP Commerce Cloud, two critical code injection flaws in Manufacturing Integration and Intelligence, and a memory corruption vulnerability in Application Server ABAP for NetWeaver and ABAP Platform. The vulnerabilities could allow unauthorized access, code execution, information disclosure, and system crashes. SAP has provided patches for these vulnerabilities as part of their August 2026 Security Patch Day. There are no reports of exploitation in the wild at this time.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
SAP's August 2026 Security Patch Day included 28 new and two updated security notes addressing multiple vulnerabilities. Four critical vulnerabilities were highlighted: CVE-2026-58231 (CVSS 10.0) in SAP Commerce Cloud allows remote attackers to bypass authentication and potentially execute code; CVE-2026-44772 (CVSS 9.9) and CVE-2026-44758 (CVSS 9.1) are critical code injection flaws in Manufacturing Integration and Intelligence that enable arbitrary command execution; and CVE-2026-34265 (CVSS 9.8) is a memory corruption issue in Application Server ABAP that can be exploited without authentication to disclose sensitive information or crash the system. Additional high-severity and medium/low-severity vulnerabilities were also addressed. SAP has released official patches for these issues.
Potential Impact
Successful exploitation of these vulnerabilities could lead to unauthorized access, remote code execution, disclosure of sensitive information, system crashes, and total infrastructure compromise. The critical vulnerabilities affect confidentiality, integrity, and availability of affected SAP applications and infrastructure. No active exploitation in the wild has been reported.
Mitigation Recommendations
SAP has released official patches for all identified vulnerabilities as part of the August 2026 Security Patch Day. Organizations using affected SAP products should apply these patches promptly to remediate the critical code injection, memory corruption, and other security issues. There are no indications that these vulnerabilities are currently exploited in the wild, but timely patching is strongly recommended.
Technical Details
- Classification
- {"confidence":0.95,"severitySource":"stated","classifier":"rss-v2"}
- Article Source
- {"url":"https://www.securityweek.com/sap-patches-critical-code-injection-memory-corruption-vulnerabilities/","fetched":true,"fetchedAt":"2026-08-11T14:26:13.259Z","wordCount":1054}
Threat ID: 6a7b3105bf8831d539ddb358
Added to database: 08/11/2026, 14:26:13 UTC
Last enriched: 08/11/2026, 14:26:44 UTC
Last updated: 08/11/2026, 14:41:30 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.