SAP Security Patch Day – August 2026

SAP Manufacturing Integration and Intelligence in the spotlight

For this month’s patch cycle, we see six notes related to SAP Manufacturing Integration and Intelligence (SAP MII). SAP MII is a manufacturing integration solution that connects shop-floor systems and equipment to enterprise systems (such as SAP ERP or SAP S/4 HANA). Technically, it is deployed on SAP NetWeaver Java. This month’s notes include:

• HotNews: Notes 3765948 and 3758900
• High priority: Notes 3759854, 3758657 and 3758910
• Medium priority: Note 3781137

SAP MII is certainly not used by every SAP customer,  but if you have SAP MII in your landscape, take special care this month to make sure you’re up to date!

HotNews

Let’s start with HotNews, the highest-priority category. This month, we have 4 notes to consider in this category. 

3765948 – Code Injection vulnerability in SAP Manufacturing Integration and Intelligence

In SAP Manufacturing Integration and Intelligence (MII), a vulnerability exists in XSL transformation which can lead to execution of arbitrary commands. After the patch is applied, system properties need to be maintained. There is no workaround. See FAQ note 3789518 for additional information.

3747367 – Memory Corruption vulnerability in SAP NetWeaver Application Server ABAP

This note was initially released as part of July’s Patch Tuesday and has been updated with updated correction information. Kernel 7.89 is now a part of the correction as well. Make sure to check whether this update is relevant for your landscape. 

3714806 – Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform

The DIAG protocol of the ABAP technology stack has been found to be vulnerable to memory corruption, potentially resulting in a significant impact on the application. This requires a kernel patch, which may have an impact on system availability. See FAQ note 3746868 for additional information.

3758900 – Code Injection vulnerability in Manufacturing Integration and Intelligence

This vulnerability also affects SAP MII and relates to the same area as note 3765948. The servlet used for XSL transformation does not properly validate supplied input, leading to the potential execution of arbitrary commands on the underlying system. There is a workaround, but, as always, the patch is strongly recommended. See FAQ document 3775178 for additional information.

High-Priority Notes

Next up is the High Priority category, with nine notes to consider this month. See the highlights below.

3772411 – Privilege Escalation vulnerability in SAP ABAP Developer Tools

The ABAP Developer Tools lack authorization checks for the SQL Console when using host expressions, which can lead to severe impact on the application. A workaround is possible using authorization objects S_TABU_NAM and S_TABU_DIS. See FAQ note 3790544 for additional information.

3773203 – Potential buffer overflow vulnerability affects SAP Commerce Cloud in public‑cloud deployments with NGINX

Almost every month, patches are released to address vulnerabilities in underlying libraries. This time, the issue concerns a vulnerable version of NGINX used by SAP Commerce Cloud. The updated version can be retrieved by customers and deployed to affected environments.

3786038 – Multiple vulnerabilities in SAP Business AI Platform (Approuter)

This note addresses multiple vulnerabilities in the Approuter component. The Approuter is a Node.js-based component used for various communication functions and is often deployed in SAP BTP environments. The highest CVSS score is 7.0. To fix these vulnerabilities, update to package 23.0.0 or higher. Interestingly: this version is not released yet… 

Note that the XSUAA redirect URIs need to be configured properly before updating the package.

Medium- and Low-Priority Notes

As we see in almost every patch cycle, the majority of security notes fall into the Medium or Low category. This time, there are fourteen and two respectively. These issues can typically be resolved by simply applying the supplied patches. We highlight additional key findings below, and for a full breakdown, please scroll to the end of this post.

3721424 – Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP

This XSS vulnerability concerns the Unified Rendering (UR) framework on ABAP systems. For further details on the implementation of Unified Rendering corrections, see notes 2504011 (SAP GUI for HTML) and 2090746 (Web Dynpro ABAP).

3772071 – Cross Site Scripting (XSS) vulnerability in SAPUI5

This XSS vulnerability concerns SAPUI5 and requires the component to be patched on affected ABAP systems. See note 3155948 for additional information on patching SAPUI5 for ABAP.