Update #1 to Security Note 1411659, SAP security note 1589641

SAP Note 1589641
High priority

SAP security note 1589641, "Update #1 to Security Note 1411659", is released on 25.05.2011. Below are the SAP recommended solution and the affected software components.

PriorityCorrection with high priority

StatusReleased for Customer

Released on25.05.2011

Description

Solution

Apply the automatic correction instructions PMEK026271 & PMEK029538 provided in Security Note 1411659.

Reason and prerequisites

Security Note 1411659 was missing correction instructions necessary to fully mitigate the identified vulnerability.

Affected components

Supplier Relationship Management > Supplier Self-Services (SRM-SUS)
Vendor Evaluation (SRM-EBP-VE)
Supplier Registration (SRM-ROS)

Full note on SAP: SAP Support Launchpad note 1589641

Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].

#Supplier Self-Services #Vendor Evaluation #Supplier Registration

Explore More

SAP Note 3765948: Code Injection via SSRF in SAP MII (CVE-2026-44772)

August 11, 2026

CVE-2026-44772, CVSS 9.9: XSL transform parameters let an authenticated user make SAP MII fetch and execute a remote stylesheet. The gate ships disabled.

SAP Note 3758900: Code Injection in SAP MII (CVE-2026-44758)

August 11, 2026

CVE-2026-44758, CVSS 9.1: the SAP MII IllumXSLTServlet compiled a caller supplied stylesheet. SAP removed the endpoint rather than patching it.

SAP Note 3759854: Directory Traversal in SAP MII (CVE-2026-44763)

August 11, 2026

CVE-2026-44763, CVSS 7.6: a save path in the SAP MII SSCE interface was assembled without containment, letting files land outside the intended folder.

SAP Note 3758657: Scheduling Authorization Gap, SAP MII (CVE-2026-44765)

August 11, 2026

CVE-2026-44765, CVSS 7.3: SAP MII scheduling functions were reachable without an authorization check. The fix adds guards and new role assignments.