Patch Day: January 2026
Released January 13, 2026 · 18 notes · Source: SAP Security Patch Day page
Scheduled for January 13, 2026 (second Tuesday)
- New
- 18
- Updated
- 0
- Critical
- 4
- High
- 4
- Highest CVSS
- 9.9
- Known exploited
- 0
Our summary
18 notes (18 new, 0 updated). 4 Critical and 4 High. Highest CVSS 9.9.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
SQL Injection Vulnerability in SAP S/4HANA Private Cloud and On-Premise (Financials – General Ledger)
Remote code execution in SAP Wily Introscope Enterprise Manager (WorkStation)
Code Injection vulnerability in SAP S/4HANA (Private Cloud and On-Premise)
Code Injection vulnerability in SAP Landscape Transformation
Privilege escalation vulnerability in SAP HANA database
All notes
SAP’s introduction states 17 new notes and 0 updates; SAP’s table lists 18 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 18 of 18
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3687749 | SQL Injection Vulnerability in SAP S/4HANA Private Cloud and On-Premise (Financials – General Ledger) New | SAP S/4HANA Private Cloud and On-Premise | Critical | 9.9 | CVE-2026-0501 |
| 3668679 | Remote code execution in SAP Wily Introscope Enterprise Manager (WorkStation) New | SAP Wily Introscope Enterprise Manager | Critical | 9.6 | CVE-2026-0500 |
| 3694242 | Code Injection vulnerability in SAP S/4HANA (Private Cloud and On-Premise) New | SAP S/4HANA | Critical | 9.1 | CVE-2026-0498 |
| 3697979 | Code Injection vulnerability in SAP Landscape Transformation New | SAP Landscape Transformation | Critical | 9.1 | CVE-2026-0491 |
| 3691059 | Privilege escalation vulnerability in SAP HANA database New | SAP HANA database | High | 8.8 | CVE-2026-0492 |
| 3675151 | OS Command Injection vulnerability in SAP Application Server for ABAP and SAP NetWeaver RFCSDK New | SAP Application Server for ABAP and SAP NetWeaver RFCSDK | High | 8.4 | CVE-2026-0507 |
| 3565506 | Multiple vulnerabilities in SAP Fiori App (Intercompany Balance Reconciliation) New | SAP Fiori | High | 8.1 | CVE-2026-0511, CVE-2026-0496, CVE-2026-0495 |
| 3688703 | Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | High | 8.1 | CVE-2026-0506 |
| 3681523 | Missing Authorization check in SAP ERP Central Component and SAP S/4HANA (SAP EHS Management) New | SAP ERP Central Component and SAP S/4HANA | Medium | 6.4 | CVE-2026-0503 |
| 3666061 | Cross-Site Scripting (XSS) vulnerability in SAP Business Connector New | SAP Business Connector | Medium | 6.1 | CVE-2026-0514 |
| 3687372 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal New | SAP NetWeaver Enterprise Portal | Medium | 6.1 | CVE-2026-0499 |
| 3638716 | Open Redirect Vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog) New | SAP Supplier Relationship Management | Medium | 4.7 | CVE-2026-0513 |
| 3122486 | Missing Authorization check in SAP Fiori App (Intercompany Balance Reconciliation) NewReleased after Patch Day | SAP Fiori | Medium | 4.3 | CVE-2026-23683 |
| 3655227 | Information Disclosure vulnerability in SAP Fiori App (Intercompany Balance Reconciliation) New | SAP Fiori | Medium | 4.3 | CVE-2026-0494 |
| 3655229 | Cross-Site Request Forgery (CSRF) vulnerability in SAP Fiori App (Intercompany Balance Reconciliation) New | SAP Fiori | Medium | 4.3 | CVE-2026-0493 |
| 3677111 | Missing Authorization check in Business Server Pages Application (Product Designer Web UI) New | Business Server Pages Application | Medium | 4.3 | CVE-2026-0497 |
| 3657998 | Insufficient Input Handling in JNDI Operations of SAP Identity Management New | SAP Identity Management | Low | 3.8 | CVE-2026-0504 |
| 3593356 | Obsolete Encryption Algorithm Used in NW AS Java UME User Mapping New | NW AS Java UME User Mapping | Low | 3.0 | CVE-2026-0510 |