SAP Patches Batch of July 2026 Flaws
CERT-FR flags a French advisory covering SAP's July 2026 patch day, fixing 22 CVEs across NetWeaver, S/4HANA, Fiori, Commerce Cloud and other products, some enabling RCE and SQL injection.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 24 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CERT-FR published an advisory summarizing SAP's July 2026 Security Patch Day, which addresses multiple vulnerabilities across a wide range of SAP products. Affected components include NetWeaver Application Server (ABAP and Java variants), S/4HANA (including Create Single Payment, Draft operation, and Project Management/PPM-PRO modules), Fiori Launchpad, Commerce Cloud, CRM WebClient UI, HANA Extended Application Services, Integration Suite (Edge Integration Cell), SAProuter on Windows, and the Change and Transport System Attach Tool. Impact categories span remote code execution, data confidentiality breaches, security policy bypass, SQL injection, and cross-site scripting (XSS).
The advisory does not indicate evidence of active exploitation; it is a routine notification directing administrators to SAP's official security bulletin for patch details across 22 distinct CVEs. Given the breadth of enterprise-critical SAP deployments affected — spanning ERP, CRM, integration, and portal technologies — organizations running unpatched versions of these components should prioritize applying the vendor's July 2026 fixes to mitigate risks of remote code execution and data exposure.
No specific threat actor, malware, or campaign is referenced in this advisory; it functions purely as a vulnerability disclosure and patch notification for SAP customers.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0877
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs