SAP Security Patch Day – January 2026

HotNews

Let’s start with HotNews, the highest-priority category. There are 6 notes in total — 4 newly released today and 2 updates.

3687749 – SQL Injection in SAP S/4HANA (Financials – General Ledger)
Insufficient validation allows an authenticated user to run crafted SQL that can read/modify/delete backend DB data. A key prerequisite for this vulnerability is an incorrect configuration of authorization object S_RFC. The workaround is to correct S_RFC but the vulnerability needs to be fixed by patching. A prime example of the importance of this authorization object for SAP Security. See also FAQ note 3700593.

3668679 – Remote Code Execution in SAP Wily Introscope Enterprise Manager
The risk here is outright remote code execution. The note describes a scenario where an attacker can craft a malicious JNLP file that leads to execution on the target side. If you run Introscope EM, this can probably be patched fast without considerable impact. Or consider the workaround. See also FAQ note 3702381.

3697979 – Code Injection in SAP Landscape Transformation
An attacker with administrative access can exploit an RFC-exposed function module to inject arbitrary ABAP/OS commands, turning a trusted integration component into an execution path. The guidance is straightforward: implement SAP’s correction so those calls can’t be weaponized for injection and execution. There is no workaround, see also FAQ note  3698186.

3694242 – Code Injection in SAP S/4HANA (Private Cloud & On-Premise)
Very much like note 3697979, this note describes how an attacker with admin privileges can abuse an RFC-exposed function module to inject arbitrary ABAP code and OS commands, effectively bypassing critical authorization controls. The remediation is simple: apply SAP’s correction, see also FAQ note 3698254.

3683579 – Multiple Apache Tomcat Vulnerabilities in SAP Commerce Cloud
Remember this note from previous month? It has been revised on the symptom and solution. Also, a workaround is described. If you use SAP Commerce Cloud, make sure to double check the note.

3685286 – Deserialization Vulnerability in SAP jConnect (SDK for ASE)
This note also stems from last months Patch Day and has only been updated slightly with a reference note (3693119).

High-Priority Notes

We only have 4 High-priority notes this month which have all been newly released. Although these are 1 category below HotNews, they are still important. We highlight the following:

3691059 – Privilege Escalation in SAP HANA Database
This note only concerns SAP HANA 2.0 SP7 and SP8 and allows an attacker to leverage a weakness to switch to another user and potentially gain administrative access. Patching the system is the only remediation.

3675151 – OS Command Injection vulnerability in SAP Application Server for ABAP and SAP NetWeaver RFCSDK
An attacker with administrative access (and the network adjacency described in the note) can inject OS commands through the vulnerable interface. A kernel update is required to fix this. The vulnerability also affects the NetWeaver RFCSDK which means that any custom developments using this SDK need to be updated as well!

3565506 – Multiple Vulnerabilities in SAP Fiori App (Intercompany Balance Reconciliation). This note addresses not 1 but 3 vulnerabilities in the SAP Fiori App Intercompany Balance Reconciliation. There is a workaround but – as always – applying the patch is the way forward. See also the other security notes – with lower priority – regarding this app.

Medium- and Low-Priority Notes

This Patch Tuesday, 9 notes fall into the Medium or Low category. See below for some highlights and for a full breakdown, scroll to the end of this post.

3666061 – XSS in SAP Business Connector
An attacker can lure users into clicking a malicious URL that triggers script execution and can lead to unauthorized access/changes in the web client context. We have seen a number of security notes for the SAP Business Connector last year and this is another one. A gentle reminder that the Business Connector is still around!

3638716 – Open Redirect in SAP SRM (Catalog SICF Handler)
An unauthenticated attacker can craft a URL that redirects victims to an attacker-controlled destination. SAP’s fix is input URL validation; the note also lists post-implementation steps/configuration that must be completed.

3593356 – Obsolete Encryption Algorithm in NW AS Java UME User Mapping
An obsolete crypto algorithm leaves encrypted user mapping data vulnerable and is fixed by applying the patch AND manually converting the data. Do not forget this last step to be secure!