SAP has released its June 2026 security patch package containing 15 security notes addressing vulnerabilities across enterprise SAP environments. This release is unusually critical, with four HotNews vulnerabilities rated up to CVSS 9.9, two High priority issues, seven Medium priority fixes, and two Low priority updates. The patches affect SAP NetWeaver Application Server ABAP and Java, SAP S/4HANA, SAP Commerce Cloud, SAP Fiori, SAP BusinessObjects BI Platform, SAP Master Data Governance, and other application components.
15
4
2
7
2
Executive Summary
- Critical SAML Signature Wrapping: CVE-2026-44748 (CVSS 9.9) in SAP NetWeaver AS ABAP and ABAP Platform lets a low-privileged attacker forge signed SAML assertions and bypass authentication assurance, resulting in cross-scope compromise of confidentiality, integrity, and availability.
- Critical Memory Corruption: CVE-2026-27671 (CVSS 9.8) in the Application Server ABAP of SAP NetWeaver and ABAP Platform allows unauthenticated remote attackers to corrupt memory via crafted requests, potentially achieving arbitrary code execution with full system compromise.
- Critical Spring Security Flaw: CVE-2026-22732 (CVSS 9.1) in SAP Commerce Cloud and SAP Data Hub stems from the bundled Spring Security framework and enables unauthenticated attackers to bypass security controls with high impact on confidentiality and integrity.
- Critical Directory Traversal: CVE-2026-40128 (CVSS 9.0) in the Web Container of SAP NetWeaver AS Java allows unauthenticated attackers to traverse outside the intended directory, leading to cross-scope compromise of confidentiality, integrity, and availability.
Critical HotNews Vulnerabilities
XML Signature Wrapping in SAML Authentication in SAP NetWeaver AS ABAP and ABAP Platform
An XML Signature Wrapping vulnerability in the SAML authentication of SAP NetWeaver AS ABAP and ABAP Platform allows a low-privileged authenticated attacker to manipulate or forge signed SAML assertions, defeating authentication assurance. With a changed scope, successful exploitation results in complete compromise of confidentiality, integrity, and availability across trust boundaries.
Memory Corruption Vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform
A memory corruption vulnerability in the Application Server ABAP of SAP NetWeaver and ABAP Platform allows unauthenticated remote attackers to corrupt memory through crafted RFC requests. Successful exploitation may lead to arbitrary code execution with complete compromise of confidentiality, integrity, and availability of the application server.
Potential Spring Security Vulnerability within SAP Commerce Cloud and SAP Data Hub
A vulnerability in the bundled Spring Security framework within SAP Commerce Cloud and SAP Data Hub allows unauthenticated remote attackers to bypass security controls. Successful exploitation results in high impact on confidentiality and integrity of the platform and the data it processes.
Directory Traversal Vulnerability in SAP NetWeaver Application Server Java (Web Container)
A directory traversal vulnerability in the Web Container of SAP NetWeaver Application Server Java allows unauthenticated attackers to access and manipulate files outside the intended directory. With a changed scope, successful exploitation results in complete compromise of confidentiality, integrity, and availability.
High Priority Security Issues
Multiple Vulnerabilities in Apache Tomcat within SAP Commerce Cloud
Multiple vulnerabilities in the bundled Apache Tomcat within SAP Commerce Cloud allow unauthenticated attackers, under complex conditions, to compromise the application server. Successful exploitation results in high impact on confidentiality and integrity of the Commerce Cloud environment.
Missing Authorization Check in Application Server ABAP of SAP NetWeaver and ABAP Platform
A missing authorization check in the Application Server ABAP of SAP NetWeaver and ABAP Platform allows a low-privileged authenticated attacker to perform unauthorized operations. Successful exploitation results in high impact on integrity and low impact on availability of the application server.
Medium Priority Vulnerabilities
Missing Caller Identification Check in ODP Data Replication APIs
A missing caller identification check in the ODP Data Replication APIs allows a high-privileged attacker to access data across scope boundaries. Successful exploitation results in high impact on confidentiality and low impact on availability of replicated data.
SQL Injection Vulnerability in SAP S/4HANA
An SQL injection vulnerability in SAP S/4HANA allows authenticated attackers to inject malicious SQL statements into backend queries. Successful exploitation results in high impact on confidentiality of business-critical data.
Reflected Cross-Site Scripting (XSS) in SAP NetWeaver AS Java (JDBC Test Servlet)
A reflected Cross-Site Scripting vulnerability in the JDBC Test Servlet of SAP NetWeaver AS Java allows unauthenticated attackers to inject malicious scripts that execute in victim browsers, with cross-scope impact on confidentiality and integrity when users interact with crafted content.
Cross-Site Scripting (XSS) Vulnerability in SAP Wily Introscope Enterprise Manager
A Cross-Site Scripting vulnerability in SAP Wily Introscope Enterprise Manager allows unauthenticated attackers, under complex conditions, to inject scripts that execute in monitoring users' browsers, leading to cross-scope impact on confidentiality and integrity.
Email Spoofing Vulnerability in SAP BusinessObjects Business Intelligence Platform
An email spoofing vulnerability in SAP BusinessObjects Business Intelligence Platform allows authenticated attackers to send messages that appear to originate from trusted addresses, leading to low impact on integrity and supporting phishing or social-engineering attacks.
Missing Authorization Check in SAP MDG (Review Match Groups Application)
A missing authorization check in the Review Match Groups Application of SAP Master Data Governance allows authenticated attackers to bypass authorization controls, leading to low impact on integrity of master data match groups.
Path Traversal Vulnerability in SAP Fiori (launchpad)
A path traversal vulnerability in the SAP Fiori launchpad allows unauthenticated attackers, under complex conditions and with user interaction, to access resources outside the intended path, leading to low impact on confidentiality and integrity.
Low Priority Security Updates
Security Misconfiguration Vulnerability in SAP Business Objects
A security misconfiguration vulnerability in SAP Business Objects (Central Management Console) allows unauthenticated attackers, under complex conditions, to obtain limited sensitive information, leading to low impact on confidentiality.
Potential Vulnerability in Apache Log4j Library used by SAP NetWeaver AS Java
A potential vulnerability in the Apache Log4j library used by SAP NetWeaver AS Java allows high-privileged attackers, under complex conditions, to affect the User Management Engine with low impact on confidentiality and integrity.
Security Advisory prepared by RedRays Cybersecurity Team
Based on SAP Security Notes published 9 June 2026.
© 2026 RedRays. Test patches in development environments before production deployment.
