SAP Security Patch Day – June 2026

HotNews

As always, we’ll start with the HotNews notes, the highest-priority category. This month, we have 6 notes to consider in this category.

3746332 – XML Signature Wrapping in SAML Authentication in SAP NetWeaver AS ABAP and ABAP Platform

This vulnerability allows a user to tamper with XML signatures so identity can be misrepresented. This issue can be fixed by disabling SAML authentication altogether but the permanent fix is – off course – to apply the correction to the relevant ABAP system in the landscape. See FAQ note 3751245 for additional information.

3717897 – Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform

ABAP-based systems use the RFC protocol, a proprietary SAP protocol used for over 30 years. This vulnerability concerns improper validation of RFC requests that can lead to memory corruption with serious consequential impact. The fix requires a kernel update, so plan this update accordingly. There is no workaround, see FAQ note 3746936 for additional information.

3748262 – Potential Spring Security vulnerability within SAP Commerce Cloud and SAP Data Hub

Every patch cycle, we see vulnerabilities come by that are based on the use of insecure 3rd party libraries or frameworks. Because of this, the software that makes use of these components need an update as well. The same applies to this patch on SAP Commerce Cloud and Data Hub; because of an issue in Sprint Security, these software stacks must be updated. There is no workaround, see FAQ note 3761279 for additional information.

3727078 – Directory Traversal vulnerability in SAP NetWeaver Application Server Java (Web Container) 

A well-known tactic is the so-called ‘path traversal’ attack. This is basically an attack where files, directories or code is accessed outside of the intended context. This vulnerability is of this category. It allows ‘malicious’ HTTP logon requests to access the file system level and processing of files which can have serious impact. There is no workaround, apply the patch to remediate. See FAQ note 3758864 for additional information.

3733064 – Missing authentication check in SAP Commerce Cloud configuration

This note was released as part of the May release last month. It has been updated with textual changes only, so no real additional security risks to consider.

3747787 – Malicious open-source packages in SAP Cloud Application Programming Model & MTA Build Tool

Remember this note from last month? SAP released this one as ‘HotNews’ but also with a CVSS score of 0.0. That has not changed but what has changed, is that another malicous npm package has been identified. So again: if you make use of npm packages, make sure to double check according to the latest update in the note!

 

High-Priority Notes

Next up is the High Priority category. A level lower than HotNews but no reason to consider these notes as unimportant. There are 3 notes in this category this month. 

3732471 – OS Command Injection Vulnerability in SAP Forecasting & Replenishment

This note has been updated slightly with new information about support packages and correction instructions for SCM. Make sure to double check if these versions are relevant for your SCM landscape.

3747484 – Multiple vulnerabilities in Apache Tomcat within SAP Commerce Cloud

Another note concerning SAP Commerce Cloud and another example of issues because 3rd party libraries are used! This time, it is – again – Apache Tomcat causing the issues by having multiple vulnerabilities. Patching is the remedy, see FAQ note 3761235 for additional information.

3735546 – Missing Authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform

This vulnerability with High Priority simply requires the patch to be applied. Sometimes, it is just this easy and yet so important…

Medium- and Low-Priority Notes

As we see almost every patch cycle, the majority of security notes fall into the Medium or Low category. This time 9 and 2 respectively. These issues can typically be resolved by simply applying the supplied patches. We highlight additional key findings below, and for a full breakdown, please scroll to the end of this post.

3748819 – Missing caller identification check-in for ODP Data Replication APIs

This note is listed as a security note but looking at the issue, it is a slightly different story. As explained in note 3255746 SAP has tightened the use of ODP Data Replication APIs as these are ‘intended and designed exclusively for facilitating data transfer between SAP applications”. One of the results of this, is the release of note 3748819 that disables other use of these APIs. Take note if this functionality is used in your landscape!

3682699 – Path Traversal Vulnerability in SAP Fiori (launchpad)

This vulnerability concerns SAP Fiori launchpad and the fix is provided within an updated version of UI5. Patching UI5 is always a bit different so take note of the instructions in note 3155948.