补丁日：2026年1月
发布于 2026年1月13日 · 18 条安全说明 · 来源：SAP 安全补丁日页面
计划日期：2026年1月13日（每月第二个星期二）
- 新发布
- 18
- 更新
- 0
- 严重
- 4
- 高
- 4
- 最高 CVSS
- 9.9
- 已被利用
- 0
本月摘要
共 18 条安全说明（新发布 18 条，更新 0 条），其中严重 4 条、高 4 条，最高 CVSS 9.9。
优先修补
排序依据：是否已知被利用（CISA KEV），其次是 SAP 优先级，再次是 CVSS 分数。仅供分诊参考，不能替代您自己的风险评估。
SQL Injection Vulnerability in SAP S/4HANA Private Cloud and On-Premise (Financials – General Ledger)
Remote code execution in SAP Wily Introscope Enterprise Manager (WorkStation)
Code Injection vulnerability in SAP S/4HANA (Private Cloud and On-Premise)
Code Injection vulnerability in SAP Landscape Transformation
Privilege escalation vulnerability in SAP HANA database
全部安全说明
SAP 简介中写明 17 条新安全说明和 0 条更新；SAP 表格共列出 18 行（两者可能不同，例如包含 GitHub 安全公告或补发条目）。
SAP 公告中的最高优先级在 2024 年 12 月及以前标为 “Hot News”，自 2024 年 10 月起标为 “Critical”；本站统一显示为“严重”。
显示 18 / 18
| 标题 | CVE | ||||
|---|---|---|---|---|---|
| 3687749 | SQL Injection Vulnerability in SAP S/4HANA Private Cloud and On-Premise (Financials – General Ledger) 新发布 | SAP S/4HANA Private Cloud and On-Premise | 严重 | 9.9 | CVE-2026-0501 |
| 3668679 | Remote code execution in SAP Wily Introscope Enterprise Manager (WorkStation) 新发布 | SAP Wily Introscope Enterprise Manager | 严重 | 9.6 | CVE-2026-0500 |
| 3694242 | Code Injection vulnerability in SAP S/4HANA (Private Cloud and On-Premise) 新发布 | SAP S/4HANA | 严重 | 9.1 | CVE-2026-0498 |
| 3697979 | Code Injection vulnerability in SAP Landscape Transformation 新发布 | SAP Landscape Transformation | 严重 | 9.1 | CVE-2026-0491 |
| 3691059 | Privilege escalation vulnerability in SAP HANA database 新发布 | SAP HANA database | 高 | 8.8 | CVE-2026-0492 |
| 3675151 | OS Command Injection vulnerability in SAP Application Server for ABAP and SAP NetWeaver RFCSDK 新发布 | SAP Application Server for ABAP and SAP NetWeaver RFCSDK | 高 | 8.4 | CVE-2026-0507 |
| 3565506 | Multiple vulnerabilities in SAP Fiori App (Intercompany Balance Reconciliation) 新发布 | SAP Fiori | 高 | 8.1 | CVE-2026-0511, CVE-2026-0496, CVE-2026-0495 |
| 3688703 | Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform 新发布 | SAP NetWeaver AS ABAP / ABAP Platform | 高 | 8.1 | CVE-2026-0506 |
| 3681523 | Missing Authorization check in SAP ERP Central Component and SAP S/4HANA (SAP EHS Management) 新发布 | SAP ERP Central Component and SAP S/4HANA | 中 | 6.4 | CVE-2026-0503 |
| 3666061 | Cross-Site Scripting (XSS) vulnerability in SAP Business Connector 新发布 | SAP Business Connector | 中 | 6.1 | CVE-2026-0514 |
| 3687372 | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal 新发布 | SAP NetWeaver Enterprise Portal | 中 | 6.1 | CVE-2026-0499 |
| 3638716 | Open Redirect Vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog) 新发布 | SAP Supplier Relationship Management | 中 | 4.7 | CVE-2026-0513 |
| 3122486 | Missing Authorization check in SAP Fiori App (Intercompany Balance Reconciliation) 新发布补丁日之后发布 | SAP Fiori | 中 | 4.3 | CVE-2026-23683 |
| 3655227 | Information Disclosure vulnerability in SAP Fiori App (Intercompany Balance Reconciliation) 新发布 | SAP Fiori | 中 | 4.3 | CVE-2026-0494 |
| 3655229 | Cross-Site Request Forgery (CSRF) vulnerability in SAP Fiori App (Intercompany Balance Reconciliation) 新发布 | SAP Fiori | 中 | 4.3 | CVE-2026-0493 |
| 3677111 | Missing Authorization check in Business Server Pages Application (Product Designer Web UI) 新发布 | Business Server Pages Application | 中 | 4.3 | CVE-2026-0497 |
| 3657998 | Insufficient Input Handling in JNDI Operations of SAP Identity Management 新发布 | SAP Identity Management | 低 | 3.8 | CVE-2026-0504 |
| 3593356 | Obsolete Encryption Algorithm Used in NW AS Java UME User Mapping 新发布 | NW AS Java UME User Mapping | 低 | 3.0 | CVE-2026-0510 |