SAP Security Notes, January 2026

January 2026 Notes

Monthly Summary and Highlights

Full details

The complete detail of the most relevant notes is as follows:

1. SQL Injection Vulnerability in SAP S/4HANA Private Cloud and On-Premise (Financials – General Ledger) (3687749): Due to insufficient input validation an authenticated user could execute crafted SQL queries to read, modify, and delete backend database data. This leads to a high impact on the confidentiality, integrity, and availability of the application. A temporary workaround is available. CVSS v3 Base Score 9,9/ 10 [CVE-2026-0501]
2. Remote code execution in SAP Wily Introscope Enterprise Manager (WorkStation) (3668679): Due to a critical remote code execution vulnerability, an unauthenticated attacker could craft a malicious JNLP (Java Network Launch Protocol) file and host it via a public URL. Once a victim accesses this URL, the Wily Introscope Server can be leveraged to execute arbitrary commands on the victim’s application environment. This exploit poses a severe risk as it could lead to a total compromise of the application’s confidentiality, integrity, and availability. CVSS v3 Base Score 9,6/ 10 [CVE-2026-0500]
3. Code Injection vulnerability in SAP S/4HANA (Private Cloud and On-Premise) (3694242): SAP S/4HANA (Private Cloud and On-Premise) allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code/OS commands into the system, bypassing essential authorization checks. This vulnerability effectively functions as a backdoor, creating the risk of full system compromise, undermining the confidentiality, integrity and availability of the system. CVSS v3 Base Score 9,1/ 10 [CVE-2026-0498]
4. Code Injection vulnerability in SAP Landscape Transformation  (3697979): A security flaw in SAP Landscape Transformation allows an attacker with administrative privileges to exploit a vulnerability within a function module exposed via RFC. By leveraging this weakness, an unauthorized user can inject arbitrary ABAP code or OS commands into the system while bypassing critical authorization checks. This vulnerability essentially operates as a backdoor, posing a severe risk of a full system compromise the confidentiality, integrity, and availability of the entire environment. CVSS v3 Base Score 9,1/ 10 [CVE-2026-0491]
5. Privilege escalation vulnerability in SAP HANA database (3691059): SAP HANA database is vulnerable to privilege escalation allowing an attacker with valid credentials of any user to switch to another user potentially gaining administrative access. This exploit could result in a total compromise of the system’s confidentiality, integrity, and availability. CVSS v3 Base Score 8,8/ 10 [CVE-2026-0492]
6. OS Command Injection vulnerability in SAP Application Server for ABAP and SAP NetWeaver RFCSDK (3675151): Due to an OS Command Injection vulnerability in SAP Application Server for ABAP and SAP NetWeaver RFCSDK, an authenticated attacker with administrative access and adjacent network access could upload specially crafted content to the server. If processed by the application, this content enables execution of arbitrary operating system commands. Successful exploitation could lead to full compromise of the system’s confidentiality, integrity, and availability. CVSS v3 Base Score 8,4/ 10 [CVE-2026-0507]
7. Multiple vulnerabilities in SAP Fiori App (Intercompany Balance Reconciliation) (3565506): SAP Fiori App Intercompany Balance Reconciliation does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has high impact on confidentiality and integrity of the application, availability is not impacted.. CVSS v3 Base Score 8,1/ 10 [CVE-2026-0511]
8. Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform (3688703): SAP Web Due to a Missing Authorization Check vulnerability in Application Server ABAP and ABAP Platform, an authenticated attacker could misuse an RFC function to execute form routines (FORMs) in the ABAP system. Successful exploitation could allow the attacker to write or modify data accessible via FORMs and invoke system functionality exposed via FORMs, resulting in a high impact on integrity and availability, while confidentiality remains unaffected. CVSS v3 Base Score 8,1/ 10 [CVE-2026-0506]

Reference links

Other references, from SAP and Onapsis (january):

SAP Security Patch Day – January 2026

SAP Patch Day: January 2025 – Onapsis

Resources affected