Skip to content

SAP Patch Day June 2026 - two critical notes at the heart of ABAP

June's SAP Patch Day brought two HotNews notes striking at Application Server ABAP: XML Signature Wrapping in SAML (CVSS 9.9) and Memory Corruption in the RFC protocol (CVSS 9.8). The second does not even require authentication. This is a priority for this week, not a patch for later.

Jacek Bugajski Jacek Bugajski ·
LinkedIn X

June’s SAP Patch Day brought two HotNews notes striking at the foundation of most SAP landscapes - Application Server ABAP. Both carry a severity rating that cannot be left “for later”.

Abstract visualisation of two critical vulnerabilities at the core of SAP being sealed by patches - SNOK Aurora style

Note #3746332 - CVSS 9.9

XML Signature Wrapping in SAML authentication. A logged-in user with low privileges can craft a signed XML document and impersonate another user’s identity. The result is access to sensitive data and disruption to system operation.

Temporary workaround: disable SAML until the patch is deployed.

Note #3717897 - CVSS 9.8

Memory Corruption in the RFC protocol. Here, an account is not even required - an unauthenticated attacker sends a crafted RFC request and exploits a flaw in memory management.

The absence of a required authentication step means there is no natural barrier to entry.

What this means in practice

ABAP is not a peripheral component. It is the core underpinning finance, logistics and HR. A vulnerability rated 9.8 with no login requirement means that exposing RFC interfaces to the network becomes a real attack vector - not a theoretical one.

Our recommendations

  1. Prioritise both notes in the next available maintenance window - this is not a patch “for later”.
  2. Verify the exposure of RFC and SAML interfaces beyond the trusted network boundary.
  3. Where the patch cannot be deployed immediately - apply the SAML workaround and control access to the RFC gateway.

Patch Day can overwhelm with the sheer number of notes. These two, however, are not noise - they are a priority for the current week.

We deliver continuous monitoring of changes, transactions, RFC and ABAP configuration using the SecurityBridge platform - shortening the cycle from note publication to response from weeks to hours. We write more broadly about response obligations in the context of NIS2 / DORA / KSC audits for SAP.

And how does the process of deploying critical SAP notes look in your organisation - planned, or only “when something happens”? We would be happy to discuss it.

Source: SAP Security Patch Day (June 2026), Onapsis Research Labs, support.sap.com.

Tematy: Safe Tuesday sap-security SAP NetWeaver SecurityBridge PatchDay

More from this series

Safe Tuesday

AI in SAP without Joule: how to safely bring artificial intelligence into an on-premise system

Joule requires BTP and a newer SAP release. Most Polish companies run ECC or an older on-premise S/4HANA. We show how to give AI safe access to SAP data without a conversion - with UiPath as a controlled execution layer.

Safe Tuesday: Kali365 bypasses MFA via OAuth device code

The FBI has warned of a Phishing-as-a-Service platform called Kali365. The attack does not bypass MFA - it uses it as a trust-building element, exploiting the legitimate OAuth 2.0 device code flow in Microsoft 365. Five Entra ID hardening steps worth implementing within 48 hours.

Safe Tuesday: SAP Patch Day vs NIS2. CVE 10.0, 72 Hours and EUR 10 Million in Fines

The second Tuesday of May 2026 was a week ago. Your Basis team received another list of SAP security notes. If your response cycle is still measured in weeks, NIS2 and the KSC Act are changing that equation - along with fines of up to EUR 10 million.

Get in touch

Get in touch Email office@snok.ai