SAP fixes two critical vulnerabilities in its February release

SAP published its February 2026 Security Patch Day on 10 February, releasing 26 new security notes and one update to an existing note. Two of the fixes are rated critical with CVSS between 9.6 and 9.9: a code injection flaw in the scripting editor in SAP CRM and S/4HANA, and a missing authorisation check in NetWeaver Application Server ABAP. Both could allow authenticated attackers to perform arbitrary actions or escalate privileges. Further high-priority issues span NetWeaver, Supply Chain Management, BusinessObjects and Commerce Cloud, covering XML signature wrapping, denial of service and missing authorisation checks.

What this means for your organisation

SAP is usually the system keeping finance, purchasing and logistics running, and privilege escalation there hands an attacker the things that matter most. At the same time SAP environments are heavy to patch, and updates often slip to the next maintenance window. When they do, the decision to wait should be documented and made by someone with the authority, not arrived at by default.

Berigo recommends

• Determine which of the 26 notes apply to your own SAP estate, and take the two critical ones first.
• Set a date for deploying the critical fixes, and document compensating controls if you must wait.
• Review who holds authorised roles in SAP CRM, S/4HANA and NetWeaver, since both critical flaws require authentication.
• Restrict network access to SAP interfaces that do not need to be broadly reachable internally.

Source

• support.sap.com