SAP Security Patch Day — January 2026

Exploited 0

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

None of this release's vulnerabilities is known to be exploited so far.

Critical 4

• Critical 9.9
  CVE-2026-0501 SQL Injection Vulnerability in SAP S/4HANA Private Cloud and On-Premise (Financials � General Ledger)
• Critical 9.6
  CVE-2026-0500 Remote code execution in SAP Wily Introscope Enterprise Manager (WorkStation)
• Critical 9.1
  CVE-2026-0491 Code Injection vulnerability in SAP Landscape Transformation
• Critical 9.1
  CVE-2026-0498 Code Injection vulnerability in SAP S/4HANA (Private Cloud and On-Premise)

All vulnerabilities 19