SAP Security Notes: April 2026 Patch Day

HotNews Note published: Onapsis Research Labs supported SAP in patching a critical SQL Injection vulnerability

Highlights of April SAP Security Notes analysis include:

• April Summary – Twenty-two new and updated SAP security patches released, including one HotNews Note and two High Priority Notes
• SQL Injection vulnerability – CVSS 9.9 vulnerability in SAP Business Planning and Consolidation and SAP Business Warehouse requires immediate patching
• Onapsis Research Labs Contribution – Our team supported SAP in patching six vulnerabilities, covered by five SAP Security Notes, including one HotNews Note

SAP has published twenty-two new and updated SAP Security Notes in its April Patch Day, including one HotNews Note and two High Priority Notes. Five of the eighteen new SAP Security Notes were published in collaboration with the Onapsis Research Labs.

The HotNews Notes in Detail

The Onapsis Research Labs (ORL) supported SAP in patching a critical SQL Injection vulnerability in SAP Business Planning and Consolidation and SAP Business Warehouse. The vulnerable ABAP program allows a low privileged user to upload a file with arbitrary SQL statements that will then be executed. SAP Security Note #3719353, tagged with a CVSS score of 9.9, patches the vulnerability by deactivating all executable code within the affected program. As a temporary workaround, SAP recommends revoking the S_GUI authorization object with Activity 60 (Upload) from user accounts. Since this workaround can lead to side effects for the affected users in other applications and because of the criticality of the vulnerability, we strongly recommend applying the patch immediately. 

The High Priority Notes in Detail

SAP Security Note #3678282, tagged with a CVSS score of 7.5, was initially released in February 2026 and patches a Denial of Service vulnerability in SAP BusinessObjects BI Platform that was previously reported to SAP by the Onapsis Research Labs. The update only provides a minor correction to the ‘Symptom’ section of the note.

SAP Security Note #3731908, tagged with a CVSS score of 7.1, patches a Missing Authorization check vulnerability in SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise). The vulnerability allows an authenticated attacker to execute a particular ABAP program to overwrite any existing eight‑character executable program without authorization. According to SAP, a successful exploitation impacts availability, with a limited impact on integrity confined to the affected report, while confidentiality remains unaffected.

Onapsis Contribution

In addition to HotNews Note #3719353, the Onapsis Research Labs (ORL) supported SAP in patching five Medium Priority vulnerabilities, covered by four SAP Security Notes.

SAP Security Note #3705094, tagged with a CVSS score of 6.5, describes a vulnerability that poses the confidentiality of the application at high risk. Certain remote-enabled function modules in SAP Business Analytics and SAP Content Management allow an authenticated user accessing sensitive information beyond their intended permissions. After patching, the vulnerable function modules are no longer accessible remotely.

SAP Security Note #3692004, tagged with a CVSS score of 6.1, patches an Open Redirect vulnerability in SAP NetWeaver AS ABAP. The ORL team detected that an unauthenticated attacker could craft malicious URLs that, if accessed by a victim, could be redirected to the page controlled by the attacker. To avoid problems after patching, it might be necessary to extend the allow list in Unified Connectivity (UCON) or table HTTP_WHITELIST in older SAP releases without UCON.

SAP Security Note #3645228, tagged with a CVSS score of 6.1, addresses two vulnerabilities that can lead to Cross-Site Scripting in SAP Supplier Relationship Management (SICF Handler in SRM Catalog). The vulnerable ICF service allows an unauthenticated attacker to craft a malicious URL that, if accessed by a victim, results in execution of malicious content within the victim’s browser. This could allow the attacker to access and modify information, impacting the confidentiality and integrity of the application, while availability remains unaffected.

SAP Security Note #3703276, tagged with a CVSS score of 4.3, patches a Missing Authorization Check vulnerability in the Material Master application. Our team detected that a remote-enabled function module of the application does not perform sufficient authorization checks before accessing sensitive information.The vulnerability has a low impact on confidentiality and does not affect integrity and availability of the system.

Summary & Conclusions

With twenty-two SAP Security Notes, including one HotNews Note and two High Priority Notes, SAP’s April Patch Day is another busy one. The relatively low number of HotNews and High Priority Notes should not prevent you from carefully checking each and every SAP Security Note. We are proud that our Onapsis Research Labs team could once more significantly contribute to making SAP more secure.

As always, the Onapsis Research Labs is already updating The Onapsis Platform to incorporate the newly published vulnerabilities into the product so that our customers can protect their businesses.

For more information about the latest SAP security issues and our continuous efforts to share knowledge with the security community, subscribe to our monthly Defender’s Monthly Newsletter.