SAP's Critical Patches Close Zero-Day-Style Gaps

Enterprises running SAP systems faced a busy Tuesday as the software maker rolled out its August 2026 Security Patch Day, a batch of 28 new security notes, two updates to previous advisories, and one GitHub advisory. The most urgent items target a quartet of critical vulnerabilities, including one rated a perfect 10 on the CVSS scale — a flaw in SAP Commerce Cloud that could let remote attackers slip past authentication entirely and potentially seize control of affected systems.

While none of the flaws have been confirmed as exploited in the wild, the severity scores alone make these patches a priority for security teams. The highest-rated issue, CVE-2026-58231, carries a CVSS score of 10/10 and stems from an improper authorization problem in SAP Commerce Cloud's Data Hub Adapter. According to SAP, the bug could allow remote attackers to bypass authentication, likely leading to code execution and unauthorized access to internal components. Successful exploitation would impact the confidentiality, integrity, and availability of the application.

Commerce Cloud's Authentication Bypass

The Commerce Cloud flaw is especially concerning because it requires no authentication to exploit. The Data Hub Adapter is a component that facilitates data exchange between Commerce Cloud and other systems, making it a potentially attractive target for attackers seeking to pivot deeper into an enterprise network. Although SAP's advisory does not provide exploit details, the CVSS 10.0 rating signals that exploitation is straightforward and could have widespread impact.

An attacker who successfully exploits this vulnerability could gain unauthorized access to internal components, potentially leading to data theft, system manipulation, or lateral movement within the environment. The advisory notes that the impact spans confidentiality, integrity, and availability — a worst-case scenario for any organization running Commerce Cloud.

Code Injection in Manufacturing Hub

Two other critical flaws live in SAP Manufacturing Integration and Intelligence, a platform that connects manufacturing operations with enterprise systems. Tracked as CVE-2026-44772 (CVSS 9.9/10) and CVE-2026-44758 (CVSS 9.1/10), these are code injection vulnerabilities that affect vulnerable servlets. Attackers can submit specially crafted input, leading to the execution of arbitrary commands on the underlying host and total infrastructure compromise.

Application security firm Onapsis, which analyzes SAP vulnerabilities, explains that while the bugs are similar, one requires higher privileges to be exploited. This distinction matters for prioritization: the lower-privilege requirement of one flaw could make it more accessible to attackers who have already established a foothold in the network. Both vulnerabilities, however, could result in full server compromise if exploited successfully.

Memory Corruption in ABAP

The fourth critical flaw, CVE-2026-34265 (CVSS 9.8/10), is a memory corruption issue in Application Server ABAP for NetWeaver and ABAP Platform. The vulnerability is rooted in logical errors in DIAG protocol parsing, and it can be exploited without authentication to disclose sensitive information or crash the system. The impact again touches application confidentiality, integrity, and availability.

DIAG is the protocol used between SAP GUI and the application server, making this a potentially broad attack surface for organizations that use the classic SAP interface. The memory corruption occurs during parsing of DIAG messages, which could be triggered remotely, opening the door for information disclosure or denial-of-service attacks.

Prior Patch Updates

Before this month's patches, SAP had already updated a critical security note from the July 2026 Patch Day to address a critical memory corruption bug in NetWeaver Application Server ABAP. The update contains additional information, though SAP did not specify what new details were added. This follow-up suggests that SAP is actively refining guidance on that earlier flaw, possibly in response to research or increased scrutiny.

The July update was part of SAP's ongoing effort to manage vulnerabilities in its core NetWeaver stack, which underpins many enterprise deployments. The fact that SAP is revising notes within a month indicates the company is keeping close tabs on the threat landscape around these components.

High-Severity Roundup

Beyond the critical quartet, SAP released eight notes dealing with high-severity flaws across multiple products, including ABAP Developer Tools, Commerce Cloud, Change and Transport System Attach Tool, BusinessObjects, Manufacturing Integration and Intelligence, and Business AI Platform (Approuter).

The first seven notes address a range of issues: privilege escalation, buffer overflow, remote code execution (RCE), credentials disclosure, directory traversal, and missing authorization check issues. The seventh resolves 11 security defects in Approuter, which is a key component for routing requests in SAP's Business AI Platform and other cloud services. Approuter acts as a central entry point, so vulnerabilities there could have cascading effects on multiple applications.

The remaining notes in the August batch resolve medium- and low-severity vulnerabilities. SAP makes no mention of any of these flaws being exploited in the wild, which is a positive sign but not a reason for complacency given the critical ratings on the top four.

Numbers at a Glance

• 28 new security notes released
• 2 updates to previous notes
• 1 GitHub advisory
• 4 critical vulnerabilities fixed, with CVSS scores of 10.0, 9.9, 9.8, and 9.1
• 11 security defects resolved in Approuter

Why It Matters for SAP Shops

For organizations running SAP Commerce Cloud, Manufacturing Integration and Intelligence, or ABAP-based systems, this patch batch is not a routine update. The combination of a perfect CVSS score, unauthenticated attack vectors, and the potential for full infrastructure compromise makes these patches critical to deploy as soon as possible.

Even though there are no confirmed exploits in the wild, the severity of these flaws suggests that attackers may soon develop working exploits, especially given that some require no authentication. Security teams should prioritize patching based on exposure: systems with internet-facing components, or those that integrate with untrusted networks, are at greater risk.

This patch round also underscores the importance of maintaining an up-to-date inventory of SAP components, as vulnerabilities can exist in less obvious places like the Data Hub Adapter or DIAG protocol handling. The fact that SAP continues to refine its own advisories — as seen with the July update — reinforces that the threat landscape is evolving, and so should patching strategies.

For now, the immediate action is clear: review SAP's August 2026 security notes, identify which of the affected components are in use, and apply the patches in line with the risk profiles of the systems. Waiting for proof of exploitation is a gamble that could cost more than the maintenance window.