Co-founder and CTO of RedRays
SAP security note 1517825, “HCM – Potential Directory Traversal in Payroll Canada PY-CA”, is a note. Below is the security information published by SAP for this note.
Full note on SAP: SAP Support Launchpad note 1517825
Detailed exploitation and proof-of-concept material for this note is maintained in the RedRays Security Platform. For access, contact [email protected].
SAP’s November 2026 Patch Day brings 38 notes, nine HotNews and four CVSS 10.0 issues in SAML2, SAP Gateway, Web Dispatcher and ICM. What to patch first.
A remote-enabled ST-PI function module lacked an authorization check. Low impact, CVSS 3.1, but ST-PI is on almost every ABAP system.
BusinessObjects BI Platform shipped Apache Struts 6.8, which an authenticated user can use to exhaust memory. CVSS 5.3.
Some Enterprise Portal endpoints that change state had no CSRF protection. CVSS 4.3, EP 7.50.