SAP has released its January 2026 security patch package containing 17 security notes addressing critical vulnerabilities across enterprise SAP environments. This release includes four HotNews vulnerabilities with CVSS ratings up to 9.9, four High priority issues, seven Medium priority fixes, and two Low priority updates. The patches affect SAP S/4HANA, SAP HANA database, SAP NetWeaver, SAP Wily Introscope, and various application components.
RedRays ABAP Code Scanner Uncovers Critical Authorization Bypass
Our RedRays ABAP Code Scanner successfully identified a critical missing authorization vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform. This high-severity flaw allows authenticated users with low privileges to bypass authorization controls and perform unauthorized actions with significant impact on system integrity and availability.
SAP Security Note #3688703 addresses this vulnerability discovered through automated static code analysis. The advisory is scheduled for public release on March 13, 2026.
17
4
4
7
2
Executive Summary
- Critical SQL Injection: CVE-2026-0501 (CVSS 9.9) in SAP S/4HANA Financials General Ledger allows authenticated attackers to execute arbitrary SQL queries with cross-scope impact on confidentiality, integrity, and availability.
- Remote Code Execution: CVE-2026-0500 (CVSS 9.6) in SAP Wily Introscope Enterprise Manager enables unauthenticated remote code execution with complete system compromise.
- Code Injection Vulnerabilities: CVE-2026-0491 (CVSS 9.1) in SAP Landscape Transformation and CVE-2026-0498 (CVSS 9.1) in SAP S/4HANA allow high-privileged attackers to inject and execute malicious code with cross-scope impact.
- Privilege Escalation: CVE-2026-0492 (CVSS 8.8) in SAP HANA database enables authenticated users to escalate privileges and compromise database integrity.
Critical HotNews Vulnerabilities
SQL Injection in SAP S/4HANA Financials – General Ledger
Critical SQL injection vulnerability in SAP S/4HANA Private Cloud and On-Premise (Financials – General Ledger) allows authenticated attackers with low privileges to execute arbitrary SQL queries. This maximum severity flaw enables complete system compromise with cross-scope impact on confidentiality, integrity, and availability of financial data.
Remote Code Execution in SAP Wily Introscope Enterprise Manager
Critical remote code execution vulnerability in SAP Wily Introscope Enterprise Manager (WorkStation) allows unauthenticated remote attackers to execute arbitrary code with user interaction. Successful exploitation leads to complete system takeover with cross-scope impact on confidentiality, integrity, and availability.
Code Injection in SAP Landscape Transformation
Critical code injection vulnerability in SAP Landscape Transformation allows high-privileged attackers to inject and execute malicious code remotely. The vulnerability has cross-scope impact enabling complete compromise of confidentiality, integrity, and availability across connected systems.
Code Injection in SAP S/4HANA (Private Cloud and On-Premise)
Critical code injection vulnerability in SAP S/4HANA (Private Cloud and On-Premise) allows high-privileged attackers to inject and execute malicious code with cross-scope impact. Successful exploitation enables complete system takeover affecting confidentiality, integrity, and availability.
High Priority Security Issues
Privilege Escalation in SAP HANA Database
Privilege escalation vulnerability in SAP HANA database allows authenticated users with low privileges to escalate their access rights. Successful exploitation leads to complete compromise of confidentiality, integrity, and availability of the database.
OS Command Injection in SAP ABAP and NetWeaver RFCSDK
OS command injection vulnerability in SAP Application Server for ABAP and SAP NetWeaver RFCSDK allows high-privileged attackers on adjacent networks to execute arbitrary operating system commands with cross-scope impact.
Missing Authorization in SAP NetWeaver ABAP Platform
Missing authorization check vulnerability in SAP NetWeaver Application Server ABAP and ABAP Platform allows authenticated users to perform unauthorized actions with high impact on integrity and availability.
Multiple Vulnerabilities in SAP Fiori App (Intercompany Balance Reconciliation)
Multiple security vulnerabilities in SAP Fiori App (Intercompany Balance Reconciliation) allow authenticated attackers with low privileges to compromise confidentiality and integrity of financial reconciliation data.
Medium Priority Vulnerabilities
Missing Authorization in SAP EHS Management
Missing authorization check in SAP ERP Central Component and SAP S/4HANA (SAP EHS Management) allows authenticated attackers to access and modify EHS data with cross-scope impact.
Cross-Site Scripting in SAP Business Connector
Cross-Site Scripting vulnerability in SAP Business Connector allows unauthenticated attackers to inject malicious scripts that execute in victims' browsers with cross-scope impact.
Cross-Site Scripting in SAP NetWeaver Enterprise Portal
Cross-Site Scripting vulnerability in SAP NetWeaver Enterprise Portal allows unauthenticated attackers to inject and execute malicious scripts with cross-scope impact on confidentiality and integrity.
Open Redirect in SAP Supplier Relationship Management
Open redirect vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog) allows attackers to redirect users to malicious sites for phishing attacks.
Missing Authorization in Product Designer Web UI
Missing authorization check in Business Server Pages Application (Product Designer Web UI) allows authenticated users to access restricted product design information.
CSRF in SAP Fiori App (Intercompany Balance Reconciliation)
Cross-Site Request Forgery vulnerability in SAP Fiori App (Intercompany Balance Reconciliation) allows attackers to perform unauthorized actions on behalf of authenticated users.
Information Disclosure in SAP Fiori App (Intercompany Balance Reconciliation)
Information disclosure vulnerability in SAP Fiori App (Intercompany Balance Reconciliation) allows authenticated users to access sensitive financial reconciliation data beyond their authorization.
Low Priority Security Updates
Insufficient Input Handling in SAP Identity Management JNDI Operations
Insufficient input handling vulnerability in JNDI Operations of SAP Identity Management allows high-privileged attackers to manipulate JNDI lookups with limited impact on confidentiality and integrity.
Obsolete Encryption Algorithm in NW AS Java UME User Mapping
Obsolete encryption algorithm vulnerability in SAP NetWeaver AS Java UME User Mapping uses weak cryptographic algorithms that may allow information disclosure under complex attack conditions.
