SAP April 2026 Security Notes Address Critical Flaws

Affected Environment
SAP landscapes using ERP, S/4HANA, NetWeaver, HANA, BusinessObjects and related modules are affected by 19 new security notes. Both government and business entities running these SAP products face Critical risk if exposed systems are not promptly updated.

Threat Overview
Vulnerabilities include SQL injection, missing authorisation checks, code and cross-site scripting and denial-of-service issues. If exploited, they can enable unauthorised data access, data changes, session takeover and disruption or loss of critical SAP services.

Exposure Timeline
SAP released these April 2026 security updates and notes are currently available; no exploitation in the wild is reported. Enterprises are advised to assess impact and apply required patches within about ten working days to limit exposure window.

Attack Surface
Exposed SAP web interfaces, OData services, ABAP reports and Java/ABAP application servers form the main attack surface. BusinessObjects, HANA Cockpit, SRM Catalog and Apache Struts components in SAP environments expand potential entry points.

Technical Root Cause
Key issues arise from insufficient or missing authorisation checks, improper input validation and insecure session handling. Additional problems include information disclosure via system messages and legacy Apache Struts flaws in SAP components.

Exploitation Pathway
An attacker abuses weak checks or crafted inputs, URLs or SQL to access, modify or delete SAP data or child entities. XSS and code injection bugs let attackers run code in user browsers or hijack sessions if victims access crafted links or pages.