SAP Patches Critical SQL injection Vulnerability in SAP S/4HANA

Cybersecuritynews •Abinaya • May 12, 2026

On May 12, 2026, SAP released its highly anticipated monthly Security Patch Day updates, addressing numerous severe security flaws across its entire enterprise software portfolio. The most alarming discovery is a critical SQL injection vulnerability in SAP S/4HANA, giving attackers a direct path to compromise core database operations. Enterprise resource planning systems are the lifeblood […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

SAP Addresses Critical Vulnerabilities in Commerce Cloud and S/4HANA On May 12, 2026, SAP released security updates for 15 vulnerabilities, including two critical flaws in Commerce Cloud and S/4HANA. The first critical vulnerability (CVE-2026-34263) allows unauthenticated attackers to execute arbitrary code due to a missing authentication check. The second critical flaw (CVE-2026-34260) enables attackers with basic privileges to perform SQL injection attacks, potentially accessing sensitive database information or crashing the application. SAP's advisory also includes fixes for one high-severity and 11 medium-severity issues. While no exploitation of these vulnerabilities has been confirmed, CISA has previously cataloged similar SAP vulnerabilities as exploited in the wild. Organizations using affected SAP products are urged to apply the patches promptly. 6 sources 71

Extracted Entities

SAP Patches Critical SQL injection Vulnerability in SAP S/4HANA

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

Platforms (1)