Enterprise software maker SAP on Tuesday announced the release of 28 new security notes, two updates to previous notes, and a GitHub advisory.
Four of the notes published on SAP’s August 2026 Security Patch Day resolve critical vulnerabilities, the most severe of which is CVE-2026-58231 (CVSS score of 10/10), an improper authorization issue in SAP Commerce Cloud (Data Hub Adapter).
The bug could allow remote attackers to bypass authentication, likely leading to code execution and unauthorized access to internal components. Successful exploitation would impact the confidentiality, integrity, and availability of the application.
SAP also addressed two critical code injection flaws in Manufacturing Integration and Intelligence, tracked as CVE-2026-44772 (CVSS score of 9.9/10) and CVE-2026-44758 (CVSS score of 9.1/10).
Vulnerable servlets allow attackers to submit specially crafted input, leading to the execution of arbitrary commands on the underlying host and total infrastructure compromise. While the bugs are similar, one requires higher privileges to be exploited, application security firm Onapsis explains.
The fourth critical defect is CVE-2026-34265 (CVSS score of 9.8/10), which is described as a memory corruption issue in Application Server ABAP for NetWeaver and ABAP Platform.
Rooted in logical errors in DIAG protocol parsing, the vulnerability can be exploited without authentication to disclose sensitive information or crash the system, impacting application confidentiality, integrity, and availability.
Before this month’s patches, SAP updated a critical security note released on the July 2026 Patch Day to resolve a critical memory corruption bug in NetWeaver Application Server ABAP. The update contains additional information.
On Tuesday, SAP also released eight notes dealing with high-severity flaws in ABAP Developer Tools, Commerce Cloud, Change and Transport System Attach Tool, BusinessObjects, Manufacturing Integration and Intelligence, and Business AI Platform (Approuter).
The first seven notes deal with privilege escalation, buffer overflow, remote code execution (RCE), credentials disclosure, directory traversal, and missing authorization check issues, while the seventh resolves 11 security defects in Approuter.
The remaining notes released on SAP’s August 2026 Patch Day resolve medium- and low-severity vulnerabilities. SAP makes no mention of any of these flaws being exploited in the wild.
Related: Cisco Warns of High-Severity ClamAV Vulnerabilities With Public PoC
Related: Metabase Patches Vulnerability Exploited as Zero-Day
Related: CISA Urges Immediate Patching of Exploited Progress LoadMaster Vulnerability
Related: Critical One-Click Vulnerability in Atlassian’s Rovo AI Exposed Enterprise Data
