Co-founder and CTO of RedRays
SAP security note 2023449, “Switchable authorization checks for RFC in FI, FI-AP-AP, FI-AR-AR, FI-BL-MD-BK”, is a program error note. Below is the security information published by SAP for this note.
Full note on SAP: SAP Support Launchpad note 2023449
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
In August 2026 SAP released Security Note 3714806 for CVE-2026-34265. It fixes an SAP DIAG memory corruption vulnerability in SAP NetWeaver Application
SAP WebSocket vulnerability (CVSS 10): tested Snort rules plus firewall and proxy steps that protect SAP until you patch.
SAP’s November 2026 Patch Day brings 38 notes, nine HotNews and four CVSS 10.0 issues in SAML2, SAP Gateway, Web Dispatcher and ICM. What to patch first.
A remote-enabled ST-PI function module lacked an authorization check. Low impact, CVSS 3.1, but ST-PI is on almost every ABAP system.