SAP Security Patch Day, January 2026: the CVEs
Filter
SAP Security Patch Day January 2026: the CVEs SAP published on 13 January 2026, the second Tuesday of the month, with CVSS, EPSS, CISA KEV and public exploits to show what to patch first. Narrow it: in CISA KEV · critical. The same day: Microsoft, Adobe. Earlier: Dec 2025, Nov 2025, Oct 2025, Sep 2025, Aug 2025, Jul 2025, Jun 2025, May 2025, Apr 2025, Mar 2025, Feb 2025, Jan 2025. Other lists: CISA KEV list, CVE exploit search, Latest critical CVEs, Ransomware CVEs, New CVEs today, This week, Patch Tuesday
- 9.9CVE-2026-0501EPSS 0.5%
Due to insufficient input validation in SAP S/4HANA Private Cloud and On-Premise (Financials General Ledger), an authenticated user could execute crafted SQL queries to read, modify, and delete backend database data. This leads to a high i…
- 9.1CVE-2026-0491EPSS 0.5%
SAP Landscape Transformation allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code/OS commands into the system, bypassing essentia…