Patch Day: April 2026
Released April 14, 2026 · 21 notes · Source: SAP Security Patch Day page
Scheduled for April 14, 2026 (second Tuesday)
- New
- 20
- Updated
- 1
- Critical
- 2
- High
- 1
- Highest CVSS
- 9.9
- Known exploited
- 0
Our summary
21 notes (20 new, 1 updated). 2 Critical and 1 High. Highest CVSS 9.9.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
SQL Injection vulnerability in SAP Business Planning and Consolidation and SAP Business Warehouse
Malicious open-source packages in SAP Cloud Application Programming Model & MTA Build Tool
Missing Authorization check in SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise)
All notes
SAP’s introduction states 19 new notes and 1 updates; SAP’s table lists 21 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 21 of 21
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3719353 | SQL Injection vulnerability in SAP Business Planning and Consolidation and SAP Business Warehouse New | SAP Business Planning and Consolidation and SAP Business Warehouse | Critical | 9.9 | CVE-2026-27681 |
| 3747787 | Malicious open-source packages in SAP Cloud Application Programming Model & MTA Build Tool NewReleased after Patch Day | SAP Cloud Application Programming Model & MTA Build Tool | Critical | 0.0 | No CVE |
| 3731908 | Missing Authorization check in SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise) New | SAP ERP and SAP S/4 HANA | High | 7.1 | CVE-2026-34256 |
| 3680767 | Information Disclosure vulnerability in SAP Human Capital Management for SAP S/4HANA New | SAP Human Capital Management for SAP S/4HANA | Medium | 6.5 | CVE-2026-34264 |
| 3696239 | Denial of Service Vulnerability in SAP BusinessObjects Business Intelligence Platform New | SAP BusinessObjects BI Platform | Medium | 6.5 | CVE-2025-64775 |
| 3705094 | Missing Authorization check in SAP Business Analytics and SAP Content Management New | SAP Business Analytics and SAP Content Management | Medium | 6.5 | CVE-2026-34261 |
| 3715097 | Missing Authorization check in SAP S/4HANA OData Service (Manage Reference Equipment) New | SAP S/4HANA OData Service | Medium | 6.5 | CVE-2026-27677 |
| 3715177 | Missing Authorization check in SAP S/4HANA Backend OData Service (Manage Reference Structures) New | SAP S/4HANA Backend OData Service | Medium | 6.5 | CVE-2026-27678 |
| 3716767 | Missing Authorization check in SAP S/4HANA Frontend OData Service (Manage Reference Structures) New | SAP S/4HANA Frontend OData Service | Medium | 6.5 | CVE-2026-27679 |
| 3645228 | Cross-Site Scripting (XSS) vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog) New | SAP Supplier Relationship Management | Medium | 6.1 | CVE-2026-0512 |
| 3692004 | Open Redirect vulnerability in SAP NetWeaver Application Server ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.1 | CVE-2026-34257 |
| 3719397 | Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java) New | SAP NetWeaver AS Java | Medium | 6.1 | CVE-2026-27674 |
| 3730639 | Information Disclosure Vulnerability in SAP HANA Cockpit and HANA Database Explorer New | SAP HANA Cockpit and HANA Database Explorer | Medium | 5.0 | CVE-2026-34262 |
| 3703813 | Missing Authorization Check in SAP S/4HANA (Private Cloud and On-Premise) New | SAP S/4HANA | Medium | 4.9 | CVE-2026-27673 |
| 3530544 | Missing Authorization check in SAP S4CORE (Manage Journal Entries) Update | SAP S4CORE | Medium | 4.3 | CVE-2025-42899 |
| 3703276 | Missing Authorization check in Material Master Application New | Material Master Application | Medium | 4.3 | CVE-2026-27672 |
| 3711682 | Missing Authorization check in SAP S/4HANA OData Service (Manage Technical Object Structures) New | SAP S/4HANA OData Service | Medium | 4.3 | CVE-2026-27676 |
| 3702191 | Insecure Session Management vulnerability in SAP BusinessObjects Business Intelligence Platform New | SAP BusinessObjects BI Platform | Medium | 4.2 | CVE-2026-24318 |
| 3698216 | Reflected cross site scripting vulnerability in SAP BusinessObjects Business Intelligence Platform New | SAP BusinessObjects BI Platform | Medium | 4.1 | CVE-2026-27683 |
| 3665042 | CSS Injection vulnerability in SAP NetWeaver Application Server ABAP New | SAP NetWeaver AS ABAP / ABAP Platform | Low | 3.1 | CVE-2026-27680 |
| 3723097 | Code Injection vulnerability in SAP Landscape Transformation New | SAP Landscape Transformation | Low | 2.0 | CVE-2026-27675 |