Patch Day: June 2026
Released June 9, 2026 · 16 notes · Source: SAP Security Patch Day page
Scheduled for June 9, 2026 (second Tuesday)
- New
- 15
- Updated
- 1
- Critical
- 4
- High
- 2
- Highest CVSS
- 9.9
- Known exploited
- 0
Our summary
16 notes (15 new, 1 updated). 4 Critical and 2 High. Highest CVSS 9.9.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
XML Signature Wrapping in SAML Authentication in SAP NetWeaver AS ABAP and ABAP Platform
Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform
Potential Spring Security vulnerability within SAP Commerce Cloud and SAP Data Hub
Directory Traversal vulnerability in SAP NetWeaver Application Server Java (Web Container)
Multiple vulnerabilities in Apache Tomcat within SAP Commerce Cloud
All notes
SAP’s introduction states 15 new notes and 0 updates; SAP’s table lists 16 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 16 of 16
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3746332 | XML Signature Wrapping in SAML Authentication in SAP NetWeaver AS ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Critical | 9.9 | CVE-2026-44748 |
| 3717897 | Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Critical | 9.8 | CVE-2026-27671 |
| 3748262 | Potential Spring Security vulnerability within SAP Commerce Cloud and SAP Data Hub New | SAP Commerce Cloud and SAP Data Hub | Critical | 9.1 | CVE-2026-22732 |
| 3727078 | Directory Traversal vulnerability in SAP NetWeaver Application Server Java (Web Container) New | SAP NetWeaver AS Java | Critical | 9.0 | CVE-2026-40128 |
| 3747484 | Multiple vulnerabilities in Apache Tomcat within SAP Commerce Cloud New | SAP Commerce Cloud | High | 7.4 | CVE-2026-29145, CVE-2025-66614, CVE-2026-24734 |
| 3735546 | Missing Authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | High | 7.1 | CVE-2026-44751 |
| 3748819 | Missing caller identification check-in for ODP Data Replication APIs New | ODP Data Replication APIs | Medium | 6.6 | CVE-2026-44754 |
| 3751691 | SQL Injection vulnerability in SAP S/4HANA New | SAP S/4HANA | Medium | 6.5 | CVE-2026-44744 |
| 3692004 | Open Redirect vulnerability in SAP NetWeaver Application Server ABAP Update | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 6.1 | CVE-2026-34257 |
| 3723655 | Reflected Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS Java (JDBC Test Servlet) New | SAP NetWeaver AS Java | Medium | 6.1 | CVE-2026-44746 |
| 3715280 | Cross-Site Scripting (XSS) vulnerability in SAP Wily Introscope Enterprise Manager New | SAP Wily Introscope Enterprise Manager | Medium | 4.7 | CVE-2026-44757 |
| 3673181 | Missing Authorization check in SAP MDG (Review Match Groups Application) New | SAP MDG | Medium | 4.3 | CVE-2026-44750 |
| 3687096 | Email Spoofing vulnerability in SAP Business Objects Business Intelligence Platform New | SAP BusinessObjects BI Platform | Medium | 4.3 | CVE-2026-44755 |
| 3682699 | Path Traversal Vulnerability in SAP Fiori (launchpad) New | SAP Fiori | Medium | 4.2 | CVE-2026-24315 |
| 3706000 | Security Misconfiguration vulnerability in SAP Business Objects New | SAP BusinessObjects BI Platform | Low | 3.7 | CVE-2026-44743 |
| 3726899 | Potential vulnerability in Apache Log4j library used by SAP NetWeaver AS Java New | SAP NetWeaver AS Java | Low | 3.3 | CVE-2025-68161 |