SAP August 2026 Patch Day Addresses Critical Auth Bypass and Code Execution

Enterprise software provider SAP released its August 2026 Security Patch Day updates, issuing 28 new security notes, two updates to previously published notes, and a GitHub advisory. The monthly release addresses four critical-severity security flaws, headlined by an improper authorization bug in SAP Commerce Cloud tracked as CVE-2026-58231 with a maximum CVSS rating of 10/10. If exploited, these vulnerabilities allow unauthenticated remote attackers to bypass authentication controls, execute arbitrary commands on underlying hosts, disclose sensitive system data, or trigger complete denial-of-service conditions across core ERP and operational environments.

Critical Vulnerabilities: CVE-2026-58231 and SAP Core Flaws

The most severe flaw addressed in the August bundle is CVE-2026-58231, affecting the Data Hub Adapter component of SAP Commerce Cloud. The bug stems from improper authorization enforcement, allowing an unauthenticated remote attacker to bypass authentication boundaries. Successful exploitation grants access to internal application components and likely allows the execution of arbitrary code, severely compromising the confidentiality, integrity, and availability of the commerce platform.

Additionally, SAP patched two critical code injection defects residing in SAP Manufacturing Integration and Intelligence (MII):

• CVE-2026-44772 (CVSS score: 9.9/10): A critical code injection flaw located in MII web servlets. Attackers can pass specially crafted inputs to vulnerable endpoints, resulting in arbitrary OS command execution on the host system and total infrastructure compromise.
• CVE-2026-44758 (CVSS score: 9.1/10): A closely related code injection vulnerability in MII servlets that also enables arbitrary system command execution. Application security researchers at Onapsis noted that while both MII vulnerabilities share similar underlying mechanics, CVE-2026-44772 requires higher user privileges to exploit than CVE-2026-44758.

The fourth critical vulnerability is CVE-2026-34265 (CVSS score: 9.8/10), an unauthenticated memory corruption flaw in Application Server ABAP for NetWeaver and the SAP ABAP Platform. The flaw arises from logical errors during the handling and parsing of the DIAG protocol. An unauthenticated remote attacker can exploit this issue to crash the underlying application server or extract sensitive data directly from process memory.

Alongside these four new notes, SAP also updated a critical security note originally published during the July 2026 Patch Day to provide supplementary guidance regarding a separate critical memory corruption bug in NetWeaver Application Server ABAP.

Technical Mechanics and Enterprise Blast Radius

The vulnerabilities patched this month impact critical communication protocols and integration interfaces that form the backbone of SAP enterprise deployments:

• DIAG Protocol Logic Errors: The Dynamic Information and Architecture Gateway (DIAG) protocol is SAP’s proprietary network format used for client-server communication between SAP GUI endpoints and Application Server ABAP instances. Because DIAG protocol handlers process incoming traffic prior to full session authentication, logical parsing errors in DIAG interpreters expose core application servers to memory safety attacks directly over the network.
• MII Servlet Command Injection: SAP MII acts as the key interface connecting shop-floor manufacturing operations (such as SCADA and MES systems) with enterprise-level planning modules. When web servlets fail to properly sanitize input parameters passed to operating system command calls, attackers can escape execution contexts and spawn shell processes. The blast radius of an MII compromise is particularly high because it sits at the intersection of IT and Operational Technology (OT) networks, creating potential lateral movement paths into manufacturing networks.
• Commerce Data Hub Adapter Bypass: The Data Hub Adapter facilitates data replication between SAP Commerce Cloud and backend enterprise repositories. An authorization bypass on this component exposes integration pipelines handling sensitive customer data, order details, and financial transactions.

High-Severity Flaws Across the SAP Ecosystem

In addition to the critical updates, SAP published eight high-severity notes addressing a broad range of security issues across key enterprise tools:

• Approuter (Business AI Platform): A single security note addresses 11 individual security defects within Approuter, the entry point for microservices and web applications hosted on the Business AI Platform.
• ABAP Developer Tools: Patched for vulnerabilities that could lead to privilege escalation and unauthorized code execution during development workflows.
• BusinessObjects and CTS Attach Tool: Addressed issues including remote code execution (RCE), buffer overflows, directory traversal, credential disclosure, and missing authorization checks.

The remaining notes released in the August update resolve medium- and low-severity defects across various SAP components. SAP reported no evidence indicating that any of these vulnerabilities have been exploited in the wild prior to patch release.

Remediation and Defensive Actions

Organizations running affected SAP components should execute the following remediation measures immediately:

1. Apply August 2026 Security Notes: Prioritize deployment of patches for SAP Commerce Cloud (Data Hub Adapter), SAP MII, and Application Server ABAP. Refer to SAP’s Support Portal for the specific Security Note IDs applicable to your system versions.
2. Restrict DIAG Protocol Access: Ensure network perimeter firewalls and internal micro-segmentation controls restrict TCP traffic on DIAG communication ports (typically ports 3200–3299 for instance 00–99) so that only trusted presentation clients and administrative jump boxes can reach ABAP application servers.
3. Isolate MII Interfaces: Verify that SAP MII instances are not exposed directly to the public internet. Ensure reverse proxies and Web Application Firewalls (WAFs) filtering traffic to MII servlets carry strict input-sanitization rules to inspect inbound HTTP requests for command injection sequences.