Diterjemahkan oleh mesin; mungkin terdapat kesilapan. (Machine-translated; may contain errors.) Baca versi bahasa Inggeris (Read in English)
Hari Tampalan Keselamatan SAP: April 2026
Diterbitkan pada 14 April 2026 · 17 nota · Sumber: rekod CVE di CVE.org (SAP sebagai CNA)
Dijadualkan pada 14 April 2026 (Selasa kedua)
- Nota SAP
- 17
- Kritikal
- 1
- Tinggi
- 1
- CVSS tertinggi
- 9.9
- Diketahui dieksploitasi
- 0
Keutamaan diterbitkan daripada CVSS, bukan keutamaan SAP: CVSS 9.0 atau lebih ialah Kritikal, 7.0 atau lebih Tinggi, 4.0 atau lebih Sederhana, bawah 4.0 Rendah. Keutamaan SAP sendiri hanya terdapat di SAP for Me (log masuk SAP diperlukan).
Ringkasan kami
17 nota dengan CVE SAP. 1 Kritikal dan 1 Tinggi (keutamaan diterbitkan daripada CVSS, bukan keutamaan SAP). CVSS tertinggi 9.9.
Tampalan yang perlu didahulukan
Disusun mengikut: eksploitasi yang diketahui (CISA KEV), kemudian keutamaan (diterbitkan daripada CVSS, bukan keutamaan SAP), kemudian CVSS. Ini alat bantu triaj, bukan pengganti penilaian risiko anda sendiri.
SQL Injection vulnerability in SAP Business Planning and Consolidation and SAP Business Warehouse
Missing Authorization check in SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise)
Perlukan triaj nota bulan ini untuk landskap anda sendiri? Khidmat keselamatan SAP (digitaldisciple.dev)
Semua nota
Keutamaan diterbitkan daripada CVSS, bukan keutamaan SAP: CVSS 9.0 atau lebih ialah Kritikal, 7.0 atau lebih Tinggi, 4.0 atau lebih Sederhana, bawah 4.0 Rendah. Keutamaan SAP sendiri hanya terdapat di SAP for Me (log masuk SAP diperlukan).
Liputan: laman ini disusun daripada rekod CVE SAP, jadi nota tanpa CVE, nota yang hanya mempunyai CVE pihak ketiga (contohnya Apache atau OpenSSL), dan kemas kini kepada nota terdahulu tidak diliputi. Jumlahnya kira-kira 7% daripada nota baharu.
Memaparkan 17 daripada 17
| Tajuk | CVE | ||||
|---|---|---|---|---|---|
| 3719353 | SQL Injection vulnerability in SAP Business Planning and Consolidation and SAP Business Warehouse Baharu | SAP Business Planning and Consolidation and SAP Business Warehouse | Kritikal | 9.9 | CVE-2026-27681 |
| 3731908 | Missing Authorization check in SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise) Baharu | SAP ERP and SAP S/4 HANA | Tinggi | 7.1 | CVE-2026-34256 |
| 3680767 | Information Disclosure vulnerability in SAP Human Capital Management for SAP S/4HANA Baharu | SAP Human Capital Management for SAP S/4HANA | Sederhana | 6.5 | CVE-2026-34264 |
| 3705094 | Missing Authorization check in SAP Business Analytics and SAP Content Management Baharu | SAP Business Analytics and SAP Content Management | Sederhana | 6.5 | CVE-2026-34261 |
| 3715097 | Missing Authorization check in SAP S/4HANA OData Service (Manage Reference Equipment) Baharu | SAP S/4HANA OData Service | Sederhana | 6.5 | CVE-2026-27677 |
| 3715177 | Missing Authorization check in SAP S/4HANA Backend OData Service (Manage Reference Structures) Baharu | SAP S/4HANA Backend OData Service | Sederhana | 6.5 | CVE-2026-27678 |
| 3716767 | Missing Authorization check in SAP S/4HANA Frontend OData Service (Manage Reference Structures) Baharu | SAP S/4HANA Frontend OData Service | Sederhana | 6.5 | CVE-2026-27679 |
| 3645228 | Cross-Site Scripting (XSS) vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog) Baharu | SAP Supplier Relationship Management | Sederhana | 6.1 | CVE-2026-0512 |
| 3692004 | Open Redirect vulnerability in SAP NetWeaver Application Server ABAP Baharu | SAP NetWeaver AS ABAP / ABAP Platform | Sederhana | 6.1 | CVE-2026-34257 |
| 3719397 | Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java) Baharu | SAP NetWeaver AS Java | Sederhana | 6.1 | CVE-2026-27674 |
| 3730639 | Information Disclosure Vulnerability in SAP HANA Cockpit and HANA Database Explorer Baharu | SAP HANA Cockpit and HANA Database Explorer | Sederhana | 5.0 | CVE-2026-34262 |
| 3703813 | Missing Authorization Check in SAP S/4HANA (Private Cloud and On-Premise) Baharu | SAP S/4HANA | Sederhana | 4.9 | CVE-2026-27673 |
| 3703276 | Missing Authorization check in Material Master Application Baharu | Material Master Application | Sederhana | 4.3 | CVE-2026-27672 |
| 3711682 | Missing Authorization check in SAP S/4HANA OData Service (Manage Technical Object Structures) Baharu | SAP S/4HANA OData Service | Sederhana | 4.3 | CVE-2026-27676 |
| 3702191 | Insecure Session Management vulnerability in SAP BusinessObjects Business Intelligence Platform Baharu | SAP BusinessObjects BI Platform | Sederhana | 4.2 | CVE-2026-24318 |
| 3698216 | Reflected cross site scripting vulnerability in SAP BusinessObjects Business Intelligence Platform Baharu | SAP BusinessObjects BI Platform | Sederhana | 4.1 | CVE-2026-27683 |
| 3723097 | Code Injection vulnerability in SAP Landscape Transformation Baharu | SAP Landscape Transformation | Rendah | 2.0 | CVE-2026-27675 |