SAP Security Patch Day — April 2023

Exploited 0

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

None of this release's vulnerabilities is known to be exploited so far.

Critical 3

• Critical 10.0
  CVE-2023-27497 Multiple vulnerabilities in SAP Diagnostics Agent (EventLogServiceCollector)
• Critical 9.8
  CVE-2023-28765 Information Disclosure vulnerability in SAP BusinessObjects Business Intelligence Platform (Promotion Management )
  EPSS 15%
• Critical 9.0
  CVE-2023-27267 Multiple vulnerabilities in SAP Diagnostics Agent (OSCommand Bridge)
  EPSS 14%

All vulnerabilities 19