Multiple vulnerabilities in SAP products (August 11, 2026)
Multiple vulnerabilities have been discovered in SAP products. Some of them allow an attacker to cause remote arbitrary code execution, privilege escalation and compromise of data confidentiality.
CSIRTS triage
- What
- Multiple vulnerabilities across SAP products enable remote arbitrary code execution, privilege escalation, and confidentiality compromise.
- Who is affected
- Organizations running SAP applications across their product suite.
- Urgency
- Critical urgency due to remote code execution and privilege escalation capabilities affecting enterprise systems.
- Action
- Contact SAP support for specific affected product and version guidance, then apply patches to all identified vulnerable SAP systems immediately.
AI-assisted analysis generated from the source advisory — verify against the original.
Details
Original advisory: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0998/
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Moderate exploitation riskCVE-2026-338711.1% 30-day exploitation probability. Patch within normal cadence, watch for KEV listing. Riskier than 64% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-667600.12% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 2% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-582470.21% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 12% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-401300.35% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 28% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-667740.22% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 13% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-582380.26% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 18% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-667720.18% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 8% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-447640.24% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 15% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-582410.16% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 5% of all EPSS-scored CVEs.
- Low exploitation riskCVE-2026-582480.28% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 21% of all EPSS-scored CVEs.
Referenced CVEs
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
- critical[NEW] [high] SAP Patch Day August 2026: Multiple vulnerabilitiescert-bund
- unknownNCSC-2026-0302 [1.00] [M/H] Vulnerabilities patched in SAP Commerce Cloud Data Hub Adapterncsc-nl
- high[NEW] [high] Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira and Jira Service Management: Mul…cert-bund
- medium[UPDATE] [medium] Netty: Multiple vulnerabilitiescert-bund
- unknownexploitedMultiple vulnerabilities in IBM products (August 14, 2026)cert-fr-avis
- medium[UPDATE] [medium] Apache log4j: Multiple vulnerabilities allow file manipulationcert-bund
- medium[UPDATE] [medium] Red Hat JBoss Enterprise Application Platform (bouncycastle): Vulnerability allows informati…cert-bund
- criticalCVE-2026-58231: SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client…nvd
- mediumCVE-2026-66779: Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP, an…nvd
- mediumCVE-2026-66778: SAP Approuter does not sufficiently sanitize certain request headers before forwarding traffic…nvd
- mediumCVE-2026-66777: SAP Approuter does not sufficiently validate certain incoming requests before forwarding them …nvd
- mediumCVE-2026-66776: SAP Approuter does not consistently enforce integrity verification on certain session-related …nvd
Recent advisories for SAP products
A cluster of recent advisories against the same product widens the attack surface — attackers routinely chain freshly published CVEs on one product, so review these together.
- unknownNCSC-2026-0230 [1.01] [M/H] Vulnerabilities fixed in SAP productsncsc-nl · 2026-07-17
- unknownMultiple vulnerabilities in SAP products (July 15, 2026)cert-fr-avis · 2026-07-15
- unknownNCSC-2026-0230 [1.00] [M/H] Vulnerabilities fixed in SAP productsncsc-nl · 2026-07-14
- criticalexploitedCVE-2022-22536: SAP Multiple Products HTTP Request Smuggling Vulnerabilitycisa-kev · 2022-08-18
More from CERT-FR Avis de sécurité
- unknownMultiple vulnerabilities in Debian Linux kernel (August 14, 2026)2026-08-14
- unknownMultiple vulnerabilities in Elastic Kibana (August 14, 2026)2026-08-14
- unknownMultiple vulnerabilities in Netgate products (August 14, 2026)2026-08-14
- unknownMultiple vulnerabilities in SUSE Linux kernel (August 14, 2026)2026-08-14
- unknownVulnerability in Sophos products (August 14, 2026)2026-08-14