Patch Day: March 2026
Released March 10, 2026 · 16 notes · Source: SAP Security Patch Day page
Scheduled for March 10, 2026 (second Tuesday)
- New
- 15
- Updated
- 1
- Critical
- 2
- High
- 2
- Highest CVSS
- 9.8
- Known exploited
- 0
Our summary
16 notes (15 new, 1 updated). 2 Critical and 2 High. Highest CVSS 9.8.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Code Injection vulnerability in SAP Quotation Management Insurance application (FS-QUO)
Insecure Deserialization in SAP NetWeaver Enterprise Portal Administration
Denial of service (DOS) in SAP Supply Chain Management
Denial of service (DOS) vulnerability in SAP BusinessObjects BI Platform
All notes
SAP’s introduction states 15 new notes and 0 updates; SAP’s table lists 16 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 16 of 16
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3698553 | Code Injection vulnerability in SAP Quotation Management Insurance application (FS-QUO) New | SAP Quotation Management Insurance application | Critical | 9.8 | CVE-2019-17571 |
| 3714585 | Insecure Deserialization in SAP NetWeaver Enterprise Portal Administration New | SAP NetWeaver Enterprise Portal Administration | Critical | 9.1 | CVE-2026-27685 |
| 3719502 | Denial of service (DOS) in SAP Supply Chain Management New | SAP Supply Chain Management | High | 7.7 | CVE-2026-27689 |
| 3678282 | Denial of service (DOS) vulnerability in SAP BusinessObjects BI Platform Update | SAP BusinessObjects BI Platform | High | 7.5 | CVE-2026-0485 |
| 3689080 | Server-Side Request Forgery (SSRF) in SAP NetWeaver Application Server for ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.4 | CVE-2026-24316 |
| 3697355 | SQL Injection Vulnerability in SAP NetWeaver (Feedback Notification) New | SAP NetWeaver | Medium | 6.4 | CVE-2026-27684 |
| 3703856 | Missing Authorization check in SAP NetWeaver Application Server for ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.4 | CVE-2026-24309 |
| 3693543 | DOM-based Cross-Site Scripting (XSS) Vulnerability in SAP Business One (Job Service) New | SAP Business One | Medium | 6.1 | CVE-2026-0489 |
| 3703385 | Missing Authorization check in SAP Business Warehouse (Service API) New | SAP Business Warehouse | Medium | 5.9 | CVE-2026-27686 |
| 3701020 | Missing Authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal New | SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal | Medium | 5.8 | CVE-2026-27687 |
| 3708457 | Insecure Storage Protection vulnerability in SAP Customer Checkout 2.0 New | SAP Customer Checkout 2.0 | Medium | 5.6 | CVE-2026-24311 |
| 3699761 | DLL Hijacking vulnerability in SAP GUI for Windows with active GuiXT New | SAP GUI for Windows with active GuiXT | Medium | 5.0 | CVE-2026-24317 |
| 3704740 | Missing Authorization check in SAP NetWeaver Application Server for ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 5.0 | CVE-2026-27688 |
| 3707930 | Missing Authorization check in SAP Solution Tools Plug-In (ST-PI) New | SAP Solution Tools Plug-In | Medium | 5.0 | CVE-2026-24313 |
| 3700960 | Denial of Service due to Outdated OpenSSL Version in SAP NetWeaver AS Java (Adobe Document Services) New | SAP NetWeaver AS Java | Medium | 4.3 | CVE-2025-9230, CVE-2025-9232 |
| 3694383 | Missing Authorization check in SAP NetWeaver Application Server for ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | Low | 3.5 | CVE-2026-24310 |