🚨 Latest SAP Security Updates – November 2023: What You Need to Know

In November 2023, SAP released six new and updated security notes, including two HotNews notes and four rated medium priority. Here are the key points worth noting: 1. Critical update for CommonCryptoLib: SAP Security Note #3340576,...

Jacek Bugajski· Partner · CEO of SNOK·14 November 2023

In November 2023, SAP released six new and updated security notes, including two HotNews notes and four rated medium priority. Here are the key points worth noting:

Critical update for CommonCryptoLib: SAP Security Note #3340576, rated 9.8 on the CVSS scale, addresses a critical missing authorisation check in SAP CommonCryptoLib. This vulnerability could lead to a complete compromise of the affected application. The update to this note contains minor textual changes that are important for SAP HANA Database 2.0 customers.
New threats for SAP Business One: A new HotNews note, SAP Security Note #3355658 with a CVSS score of 9.6, addresses improper access control during the installation of SAP Business One.

🔍 Summary and actions: Although November’s SAP Security Patch Day was relatively quiet, the updates - particularly those relating to SAP CommonCryptoLib and Business One - require a prompt response and remediation.

💬 Worth discussing: What has been your experience deploying these security updates? Are your SAP systems already protected against these newly discovered vulnerabilities?

Topics:Othersap-security SAP S/4HANA SAP HANA

Found this useful? Please pass it on:

Other

11 September 2026

Weekly Review W37: the core does not decide, what surrounds it does

Fifteen items from the window of 11 August - 10 September 2026: SAP Security Patch Day with a 10.0 note in the kernel, the network barrier in front of SAP removed, an official MCP server for BTP administration, a benchmark of eight SAP security pillars, a hidden payload in an email summary, OWASP Agentic Skills Top 10, a near-autonomous agentic attack on Taiwan, the harness as the deciding layer, UiPath results, Cartographer, Daniel Dines's book, the ISO 42001 annex trap, a model at critical level in cyber, AI server price rises and Mistral's funding round.

9 September 2026

Your AI assistant refuses. That does not mean it is protecting you

The same request goes through once and is turned down the next time, depending on what happened earlier in the conversation. Three measurements show a refusal boundary that moves by tens of percentage points with no configuration change at all - which makes it unfit for the job our documents give it.