DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
SAP Patch Day August 2026: Mehrere Schwachstellen
Advisory ansehen veröffentlicht 2026-08-10
Ein Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen, um beliebigen Code auszuführen, Berechtigungen zu erweitern, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen oder Anmeldedaten offenzulegen, Daten zu manipulieren, SQL-Injection- oder Cross-Site-Scripting-Angriffe durchzuführen oder einen Denial-of-Service-Zustand herbeizuführen.
01
beschreibt (34)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-58231US | — | Exploit | ||
SAP Commerce Cloud allows an unauthenticated
attacker to abuse a default authentication client and submit specially crafted
input to certain functions lacking sufficient validation… | ||||
| CVE-2026-66779US | — | — | ||
Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP, an authenticated attacker could generate a malicious link and make it publicly accessibl… | ||||
| CVE-2026-66778US | — | — | ||
SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic to internal components. An unauthenticated attacker could send a specially crafted re… | ||||
| CVE-2026-66777US | — | — | ||
SAP Approuter does not sufficiently validate certain incoming requests before forwarding them to backend destinations. Due to the complexity of the required conditions, an attacker… | ||||
| CVE-2026-66776US | — | — | ||
SAP Approuter does not consistently enforce integrity verification on certain session-related request headers under specific conditions. An attacker with low privileges could send… | ||||
| CVE-2026-66775US | — | — | ||
SAP Approuter does not enforce cross-site request forgery protection on the authentication flow by default. An unauthenticated attacker could craft a malicious link and trick a vic… | ||||
| CVE-2026-66774US | — | — | ||
SAP Approuter does not consistently handle certain error conditions. An attacker with low privileges could exploit this under a non-default configuration. Successful exploitation i… | ||||
| CVE-2026-66773US | — | — | ||
A malicious or compromised OData service could disclose sensitive authentication information and inject untrusted data into the application, which may leads to a high impact on con… | ||||
| CVE-2026-66772US | —OT erhöht | — | ||
SAP BusinessObjects Business Intelligence Platform (Admin Tools) does not perform sufficient authorization check on certain administrative functionality. An attacker authenticated… | ||||
| CVE-2026-66771US | — | — | ||
SAPUI5 allows a key user with content adaptation privileges to inject malicious script content into persisted application changes. When another user subsequently opens the adapted… | ||||
| CVE-2026-66770US | — | — | ||
Due to an SQL Injection vulnerability in SAP Social intelligence, an authenticated attacker could directly inject an SQL DDL (Data Definition Language) string into the underlying d… | ||||
| CVE-2026-66764US | — | — | ||
Reprocess Bank Statement Items in SAP S/4HANA does not perform the necessary authorization checks for authenticated users, allowing them to use rules that have not been shared with… | ||||
| CVE-2026-66763US | —OT erhöht | — | ||
SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An attacker with high pri… | ||||
| CVE-2026-66761US | — | — | ||
SAP Approuter does not enforce sufficient flow control in certain functionality. An attacker with low privileges could send high volumes of data without consuming responses, causin… | ||||
| CVE-2026-66760US | — | — | ||
SAP Approuter does not correctly validate client certificates in certain callback flows. An attacker with low privileges, holding a certificate from the same trusted authority with… | ||||
| CVE-2026-58248US | — | — | ||
SAP BusinessObjects Business Intelligence Platform (Web Intelligence) allows a low-privileged attacker to upload a specially crafted spreadsheet file containing malicious external… | ||||
| CVE-2026-58247US | — | — | ||
SAP ABAP Platform allows an unauthenticated user to send a specially crafted request to an internal component. This could disclose limited, non-sensitive data from previously used… | ||||
| CVE-2026-58245US | —OT erhöht | — | ||
SAP Advanced Planning and Optimization (Model Mix Planning) contains a hardcoded credential within the source code of the application to perform authorization check to access certa… | ||||
| CVE-2026-58244US | —OT erhöht | — | ||
SAP Manufacturing Integration and Intelligence (MII) does not perform necessary authorization check on certain application function, allowing a low-privileged authenticated attacke… | ||||
| CVE-2026-58243US | —OT erhöht | — | ||
SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database oper… | ||||
20 von 34 angezeigt
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan