SAP Patches Critical CRM, S/4HANA, NetWeaver Vulnerabilities
Source SecurityWeek
Mentioned vulnerabilities
Rated by Threat Radar
Data as of 14 Oct 2026, 06:18 UTC
What to do
AI-suggested
SAP has released official security patches addressing these vulnerabilities. Organizations should promptly apply the February 2026 SAP security notes to affected systems. There are no known exploits in the wild, but timely patching is essential to prevent potential attacks. Enhanced monitoring for suspicious activity and validation of system integrity after patching are recommended. No vendor advisory indicates that no action is required or that the issues are already mitigated.
Description
SAP released critical security patches in February 2026 addressing multiple vulnerabilities in CRM, S/4HANA, and NetWeaver platforms. Two critical flaws include a code injection vulnerability in the Scripting Editor component allowing arbitrary SQL execution, and a missing authorization check in NetWeaver Application Server ABAP enabling unauthorized remote function calls. No known exploits are reported in the wild. The vulnerabilities could compromise confidentiality, integrity, and availability of enterprise systems. Organizations using SAP ERP and CRM, especially in Europe, should promptly apply these patches to prevent potential operational disruption or data breaches.