SAP Security Patch Day – March 2026

HotNews

Let’s start with the HotNews category, SAP’s highest-priority classification. There are 2 new notes this month.

3698553 — Code Injection vulnerability in SAP Quotation Management Insurance application

A common cause of vulnerabilities is the use of underlying software libraries that contain security issues. This is exactly the case here: the relevant scheduler module uses Apache Log4j (remember that one?), which is itself vulnerable and may allow the execution of arbitrary code. The solution is to apply the patch or manually update the component; alternatively, there is also a workaround to consider. See also note 3720225.

3714585 — Insecure Deserialization in SAP NetWeaver Enterprise Portal Administration

This vulnerability is another example of an issue we have seen quite frequently lately: insecure deserialization. The patch introduces additional content validation and should be imported, as there is no workaround available. See also FAQ note 3724167.

High-Priority Notes

We have 2 High-priority notes this month. One of them, note 3697567, was updated with only minor textual changes, so we focus here on the newly released note below.

3719502— Denial of service (DOS) in SAP Supply Chain Management

This vulnerability is caused by a function module that allows uncontrolled looping, which can result in a DoS condition. The only solution is to import the patch.

Medium- and Low-Priority Notes

As is often the case, the majority of Security Notes fall into the Medium or Low category. This month, there are 15 Medium-priority notes and 1 Low-priority note. In many cases, the main recommendation is simply to patch and resolve the issue. Still, a few notes are worth highlighting below. For a full breakdown, scroll to the end of this post.

3708457 – Insecure Storage Protection vulnerability in SAP Customer Checkout 2.0

SAP Customer Checkout is a solution that may not be widely known across the SAP customer base. It involves a local Java-based installation that stores data insecurely. New customers should make sure to use the updated version. Existing customers, meanwhile, should pay close attention to the manual steps required to enable the correct secure storage option.

3700960 – [Multiple CVEs] Denial of Service due to Outdated OpenSSL Version in SAP NetWeaver AS Java (Adobe Document Services)

Many customers and administrators do not realize that their SAP NetWeaver Java system often includes additional installed components. Adobe Document Services is one such component, and it is often present whether it is actively used or not. These components can easily go unnoticed and so can the related security issues. In this case, an outdated OpenSSL version (again, an underlying library) introduces a vulnerability into the system. Make sure to patch it, and while you are at it, review which components are installed and which ones are actually needed. Reducing the attack surface as much as possible is an important step toward cyber resilience.