SAP Security Patch Day – May 2026

HotNews

Let’s start with HotNews, the highest-priority category. This month, we have 3 notes to consider in this category.

3733064 – Missing authentication check in SAP Commerce Cloud configuration

In SAP Commerce Cloud, a configuration upload functionality exists that can be exploited for arbitrary code execution. The issue is caused by a Spring Security configuration and the patches mentioned by the note disable this functionality by default. Important: rebuild and redeployment is required to fix the issue! This will require downtime, see FAQ note 3746113 for additional information.

3724838 – SQL injection vulnerability in SAP S/4HANA (SAP Enterprise Search for ABAP)

This vulnerability is caused by user input that is not validated securely. This allows an (authenticated) attacker to inject SQL statements for further exploitation. Many SAP Basis versions are affected and the patch should be applied regardless of whether the search function is used. The patch can be implemented without interruption and no impact on functionality so there is no real reason to not implement this patch swiftly. See FAQ note 3747935.

3747787 – Malicious open-source packages in SAP Cloud Application Programming Model & MTA Build Tool

This HotNews note is a bit of a ‘strange one’ in terms of classification. It has been released earlier this month as a HotNews note because of the severity of the identified issues. At the same time, the note has been given a CVSS score of 0.0 by SAP… Let this not lower your guard because this note is a HotNews note for a good reason. If you have build applications using NPM packages, make sure to check that these do not include the affected versions. Review the note carefully and take corresponding action! See also the separate blog we wrote on this topic.

Remark: we list the note with CVSS 10.0 instead of 0.0 below to underline its importance.

High-Priority Notes

Next up is the High Priority category of which we have only 1 note to consider this month. 

3732471 – OS Command Injection Vulnerability in SAP Forecasting & Replenishment

This OS Command Execution vulnerability exists in the mentioned version of SAP SCM and simply requires patching to mitigate.

Medium- and Low-Priority Notes

As we see almost every patch cycle, the majority of security notes fall into the Medium or Low category. This time 11 and 1 respectively. These issues can typically be resolved by simply applying the supplied patches. We highlight additional key findings below, and for a full breakdown, please scroll to the end of this post.

Business Server Pages (BSP) anyone?

BSP may be considered an ‘outdated’ technology from the past, superseded by the likes of SAPUI5/Fiori. That does not mean you can skip it altogether! This month we have no less than 3 security notes related to BSP which shows how long technology can ‘linger’ in an IT landscape and should not be forgotten.

3727717 – Cross-Site Scripting (XSS) vulnerability in Business Server Pages Application (TAF_APPLAUNCHER)

Component Based Test Automation (CBTA) uses a BSP application called TAF_APPLAUNCHER. If you don’t use CBTA, it can be disabled as a workaround, apply the fix for a permanent solution.

3721959 – Missing Authorization Check in SAP Strategic Enterprise Management (BSP application Balanced Scorecard Wizard)

A missing authorization check allows a user to exploit the Business Scorecard wizard in SAP SEM. Apply the patch to fix (or disable the functionality altogether as a workaround).

3728690 – Reflected Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on Business Server Pages)

An XSS vulnerability was discovered because of URL parameters that lack proper encoding on BSP pages. This requires patching of the SAP Basis component. 

Further remarks

3716450 – [CVE-2025-68161] Potential Improper Certificate Validation in SAP Commerce Cloud (Apache Log4j)

Another vulnerability was discovered in SAP Commerce Cloud and yet again because of a vulnerability in an underlying component: the (infamous) Apache Log4j library. SAP Commerce Cloud in the public cloud is not affected. For other versions, see the note for rebuild and redeploy actions.

3726962 – [CVE-2026-40131] SQL Injection vulnerability in SAP HANA Deployment Infrastructure (HDI) deploy library

This note may have the lowest CVSS score but gives an indication on how to check if the system has been actually exploited. Something that is not often specified in security notes!