SAP Patchday: Critical vulnerabilities allow unauthorized login

Business software company SAP has released 15 new security notes for the May Patchday . The developers classify two of the vulnerabilities addressed as critical risks. Attackers can inject database commands via SQL injection or bypass authentication, for example.

On the SAP Patchday overview page , the company lists the individual security notes. In SAP S/4HANA (SAP Enterprise for ABAP), authenticated attackers can inject malicious SQL queries that are not sufficiently filtered. This allows them to gain unauthorized access to the underlying database or crash the SAP application ( CVE-2026-34260 , CVSS 9.6 , Risk “ critical ”). An incorrect configuration of Spring Security in SAP Commerce Cloud also allows unauthenticated attackers to upload malicious configurations and inject code – leading to the execution of arbitrary code on the server side ( CVE-2026-34263 , CVSS 9.6 , Risk “ critical ”).

In SAP Forecasting & Replenishment, there is also a vulnerability that allows malicious actors to inject commands into the operating system ( CVE-2026-34259 , CVSS 8.2 , Risk “ high ”). The remaining reports mostly represent a medium risk and affect:

SAP is also addressing a low-threat vulnerability in SAP HANA Deployment Infrastructure (HDI) deploy library. IT managers should check if they are using vulnerable SAP software and apply the available patches promptly.

The SAP Patchday in April was slightly more extensive: developers had to fix 19 vulnerabilities. One of them was considered critical and was also of the SQL injection type.

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.