Diterjemahkan oleh mesin; mungkin terdapat kesilapan. (Machine-translated; may contain errors.) Baca versi bahasa Inggeris (Read in English)
Hari Tampalan Keselamatan SAP: Januari 2026
Diterbitkan pada 13 Januari 2026 · 18 nota · Sumber: rekod CVE di CVE.org (SAP sebagai CNA)
Dijadualkan pada 13 Januari 2026 (Selasa kedua)
- Nota SAP
- 18
- Kritikal
- 4
- Tinggi
- 4
- CVSS tertinggi
- 9.9
- Diketahui dieksploitasi
- 0
Keutamaan diterbitkan daripada CVSS, bukan keutamaan SAP: CVSS 9.0 atau lebih ialah Kritikal, 7.0 atau lebih Tinggi, 4.0 atau lebih Sederhana, bawah 4.0 Rendah. Keutamaan SAP sendiri hanya terdapat di SAP for Me (log masuk SAP diperlukan).
Ringkasan kami
18 nota dengan CVE SAP. 4 Kritikal dan 4 Tinggi (keutamaan diterbitkan daripada CVSS, bukan keutamaan SAP). CVSS tertinggi 9.9.
Tampalan yang perlu didahulukan
Disusun mengikut: eksploitasi yang diketahui (CISA KEV), kemudian keutamaan (diterbitkan daripada CVSS, bukan keutamaan SAP), kemudian CVSS. Ini alat bantu triaj, bukan pengganti penilaian risiko anda sendiri.
SQL Injection Vulnerability in SAP S/4HANA Private Cloud and On-Premise (Financials – General Ledger)
Remote code execution in SAP Wily Introscope Enterprise Manager (WorkStation)
Code Injection vulnerability in SAP S/4HANA (Private Cloud and On-Premise)
Code Injection vulnerability in SAP Landscape Transformation
Privilege escalation vulnerability in SAP HANA database
Perlukan triaj nota bulan ini untuk landskap anda sendiri? Khidmat keselamatan SAP (digitaldisciple.dev)
Semua nota
Keutamaan diterbitkan daripada CVSS, bukan keutamaan SAP: CVSS 9.0 atau lebih ialah Kritikal, 7.0 atau lebih Tinggi, 4.0 atau lebih Sederhana, bawah 4.0 Rendah. Keutamaan SAP sendiri hanya terdapat di SAP for Me (log masuk SAP diperlukan).
Liputan: laman ini disusun daripada rekod CVE SAP, jadi nota tanpa CVE, nota yang hanya mempunyai CVE pihak ketiga (contohnya Apache atau OpenSSL), dan kemas kini kepada nota terdahulu tidak diliputi. Jumlahnya kira-kira 7% daripada nota baharu.
Memaparkan 18 daripada 18
| Tajuk | CVE | ||||
|---|---|---|---|---|---|
| 3687749 | SQL Injection Vulnerability in SAP S/4HANA Private Cloud and On-Premise (Financials – General Ledger) Baharu | SAP S/4HANA Private Cloud and On-Premise | Kritikal | 9.9 | CVE-2026-0501 |
| 3668679 | Remote code execution in SAP Wily Introscope Enterprise Manager (WorkStation) Baharu | SAP Wily Introscope Enterprise Manager | Kritikal | 9.6 | CVE-2026-0500 |
| 3694242 | Code Injection vulnerability in SAP S/4HANA (Private Cloud and On-Premise) Baharu | SAP S/4HANA | Kritikal | 9.1 | CVE-2026-0498 |
| 3697979 | Code Injection vulnerability in SAP Landscape Transformation Baharu | SAP Landscape Transformation | Kritikal | 9.1 | CVE-2026-0491 |
| 3691059 | Privilege escalation vulnerability in SAP HANA database Baharu | SAP HANA database | Tinggi | 8.8 | CVE-2026-0492 |
| 3675151 | OS Command Injection vulnerability in SAP Application Server for ABAP and SAP NetWeaver RFCSDK Baharu | SAP Application Server for ABAP and SAP NetWeaver RFCSDK | Tinggi | 8.4 | CVE-2026-0507 |
| 3565506 | Multiple vulnerabilities in SAP Fiori App (Intercompany Balance Reconciliation) Baharu | SAP Fiori | Tinggi | 8.1 | CVE-2026-0495, CVE-2026-0496, CVE-2026-0511 |
| 3688703 | Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform Baharu | SAP NetWeaver AS ABAP / ABAP Platform | Tinggi | 8.1 | CVE-2026-0506 |
| 3681523 | Missing Authorization check in in SAP ERP Central Component and SAP S/4HANA (SAP EHS Management) Baharu | SAP ERP Central Component and SAP S/4HANA | Sederhana | 6.4 | CVE-2026-0503 |
| 3666061 | Cross-Site Scripting (XSS) vulnerability in SAP Business Connector Baharu | SAP Business Connector | Sederhana | 6.1 | CVE-2026-0514 |
| 3687372 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal Baharu | SAP NetWeaver Enterprise Portal | Sederhana | 6.1 | CVE-2026-0499 |
| 3638716 | Open Redirect Vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog) Baharu | SAP Supplier Relationship Management | Sederhana | 4.7 | CVE-2026-0513 |
| 3122486 | Missing Authorization check in SAP Fiori App (Intercompany Balance Reconciliation) BaharuDiterbitkan di luar Hari Tampalan | SAP Fiori | Sederhana | 4.3 | CVE-2026-23683 |
| 3655227 | Information Disclosure vulnerability in SAP Fiori App (Intercompany Balance Reconciliation) Baharu | SAP Fiori | Sederhana | 4.3 | CVE-2026-0494 |
| 3655229 | Cross-Site Request Forgery (CSRF) vulnerability in SAP Fiori App (Intercompany Balance Reconciliation) Baharu | SAP Fiori | Sederhana | 4.3 | CVE-2026-0493 |
| 3677111 | Missing Authorization check in Business Server Pages Application (Product Designer Web UI) Baharu | Business Server Pages Application | Sederhana | 4.3 | CVE-2026-0497 |
| 3657998 | Insufficient Input Handling in JNDI Operations of SAP Identity Management Baharu | SAP Identity Management | Rendah | 3.8 | CVE-2026-0504 |
| 3593356 | Obsolete Encryption Algorithm Used in NW AS Java UME User Mapping Baharu | NW AS Java UME User Mapping | Rendah | 3.0 | CVE-2026-0510 |