SAP patches XSS, SQLi in NetWeaver, S/4HANA
SAP's June 2026 security update addresses multiple vulnerabilities including SQL injection, cross-site scripting, and security policy bypasses across Business Objects, NetWeaver, S/4HANA, and other enterprise products.
SAP released its June 2026 security bulletin addressing multiple vulnerabilities across its enterprise product portfolio. The affected systems include Business Objects Business Intelligence Platform, Commerce Cloud, Fiori, NetWeaver Application Server (both Java and ABAP variants), S/4HANA, and Wily Introscope Enterprise Manager. The vulnerabilities span versions dating back several years, with numerous SAP_BASIS, KERNEL, and component-specific releases requiring patches.
The security flaws enable attackers to perform SQL injection attacks, cross-site scripting, and bypass security policies. Fifteen CVEs are associated with this advisory, ranging from CVE-2025-68161 to CVE-2026-44757. The vulnerabilities affect critical enterprise systems used for business intelligence, e-commerce, application platforms, and data management across organizations.
Organizations running SAP products should consult the vendor's security bulletin and apply the latest security patches to affected versions. The broad scope of affected products and versions indicates this is a significant patch cycle requiring immediate attention from SAP administrators.
Mentioned in this report
Detection guidance
Command Interpreter Spawned by SAP NetWeaver/Application Server Process
Detects cmd/powershell/shell child processes spawned from SAP NetWeaver, S/4HANA or Business Objects server processes, indicative of post-exploitation of a public-facing SAP vulnerability (e.g. SQLi/XSS/security bypass leading to RCE). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Command Interpreter Spawned by SAP NetWeaver/Application Server Process
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- \jlaunch.exe
- \disp+work.exe
- \sapstartsrv.exe
- \icman.exe
- \msg_server.exe
- \igsserver.exe
selection_child:
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \bash.exe
- \sh.exe
filter_known_admin:
CommandLine|contains:
- sapcontrol
- -nostart
condition: selection_parent and selection_child and not filter_known_admin
falsepositives:
- Legitimate SAP administration scripts invoking shell utilities for maintenance tasks
- Scheduled backup or monitoring scripts launched by SAP kernel processes
level: high
tags:
- attack.t1190
- attack.t1059
id: 0cd5eb97-8e42-5ec6-90ae-b9d1d845f44a
status: experimental
author: Vorant
Shell Process Spawned by SAP Kernel Daemon on Linux
Detects a shell or scripting interpreter spawned by SAP kernel/application server daemons on Linux, consistent with exploitation of a NetWeaver/ABAP public-facing vulnerability leading to command execution. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Shell Process Spawned by SAP Kernel Daemon on Linux
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|endswith:
- /disp+work
- /sapstartsrv
- /icman
- /msg_server
- /gwrd
selection_child:
Image|endswith:
- /bash
- /sh
- /dash
- /python3
- /perl
condition: selection_parent and selection_child
falsepositives:
- SAP-provided maintenance or health-check scripts invoked from kernel processes
- Third-party monitoring agents integrated with SAP daemons
level: medium
tags:
- attack.t1190
- attack.t1059
id: 87f2a881-f905-59f2-873a-caf00ec112e2
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0715
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free