Critical SAP Vulnerabilities Let Attackers Inject Malicious Code and Corrupt Memory

SAP’s August 2026 Security Patch Day has delivered a substantial round of fixes, addressing 28 new security notes and one GitHub security advisory, alongside two updates to previously released notes.

Released on August 11, 2026, this patch batch mitigates several critical-severity flaws that could allow unauthenticated attackers to inject malicious code, corrupt system memory, and escalate privileges across widely deployed enterprise platforms.

Given the extensive enterprise reliance on SAP systems for enterprise resource planning, finance, supply chain, and commerce operations, security teams are strongly advised to treat this update cycle as an emergency priority.

Critical SAP Vulnerabilities Enable Malicious Code Injection

The most alarming issue resolved this month is an improper authorization vulnerability in SAP Commerce Cloud’s Data Hub Adapter. Tracked as CVE-2026-58231, the flaw carries a maximum CVSS score of 10.0 and affects COM_CLOUD versions 2211 and 2211-JDK21.

Its maximum severity rating indicates that exploitation requires no prior privileges or user interaction, granting remote attackers complete control over confidentiality, integrity, and availability.

Following closely is a critical code injection vulnerability in SAP Manufacturing Integration and Intelligence, designated as CVE-2026-44772 with a CVSS score of 9.9.

Impacting XMII and MII_ADMIN versions 15.4 and 15.5, successful exploitation allows adversaries to execute arbitrary code within production-critical manufacturing software.

A second code injection bug in the same component, CVE-2026-44758 (CVSS 9.1), rounds out the critical tier.

Memory corruption risks also feature prominently in this release cycle. Tracked as CVE-2026-34265 with a CVSS score of 9.8, a severe memory corruption bug impacts the Application Server ABAP component within SAP NetWeaver and the ABAP Platform.

The vulnerability spans a wide range of kernel versions, from 7.22 up to the modern 9.19 releases.

Memory corruption flaws in core application servers are particularly dangerous because adversaries can weaponize them to achieve remote code execution, establishing initial access to pivot laterally across corporate networks.

Mitigating such systemic memory issues requires organizations to patch critical SAP vulnerabilities before threat actors build reliable exploit chains.

As outlined in the official SAP August 2026 Security Patch Day advisory, enterprise systems face continuous targeting from sophisticated threat groups. Applying these patches prevents adversaries from weaponizing unpatched infrastructure or leveraging SQL injection flaws against core business databases.

Beyond the critical-rated bugs, several high-severity issues demand immediate remediation:

• Privilege Escalation (CVE-2026-58243): Scores 8.8 and affects a broad range of SAP_BASIS versions inside SAP ABAP Developer Tools.
• Public-Cloud Buffer Overflow (CVE-2026-42945): Scores 8.1 and impacts SAP Commerce Cloud environments running NGINX in public-cloud configurations.
• CTS Attach Tool RCE (CVE-2026-58233): Updated guidance for a remote code execution flaw in the Change and Transport System Attach Tool (ctsattach), originally disclosed in July 2026.
• Additional High-Severity Notes: Cover credential disclosure in the SAP BusinessObjects Business Intelligence Platform, as well as directory traversal and missing authorization checks in Manufacturing Integration and Intelligence.

The medium and low-severity notes address a broad spectrum of flaws across various modules.

These include cross-site scripting (XSS) in SAPUI5 and NetWeaver Application Server ABAP, SQL injection in SAP Social Intelligence, XML External Entity (XXE) injection in BusinessObjects, a vulnerable pyodata Python library flaw (GHSA-hc5j-q32w-c25v), and an information disclosure issue in the Bouncy Castle Java library utilized by Commerce Cloud.

Due to the wide footprint of impacted products including NetWeaver, ABAP Platform, Commerce Cloud, BusinessObjects, and Manufacturing Integration and Intelligence security administrators must prioritize applying these SAP security updates immediately.

1. Identify Exposed Instances: Inventory all public-facing and internal SAP deployments running Commerce Cloud, NetWeaver, or MII.
2. Prioritize Critical Notes: Apply patches for CVE-2026-58231, CVE-2026-44772, and CVE-2026-34265 on an emergency maintenance schedule.
3. Audit Developer Tools: Update SAP_BASIS modules to resolve privilege escalation risks in developer environments.
4. Verify Third-Party Libraries: Ensure underlying dependencies like pyodata and Bouncy Castle are updated across custom app extensions.

[Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model -> Register Now