SAP Security Patch Day — May 2026

Exploited 0

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

None of this release's vulnerabilities is known to be exploited so far.

Critical 2

• Critical 9.6
  CVE-2026-34260 SQL injection vulnerability in SAP S/4HANA (SAP Enterprise Search for ABAP)
• Critical 9.6
  CVE-2026-34263 Missing authentication check in SAP Commerce cloud configuration

All vulnerabilities 15