SAP’s January 2026 Security Updates Patch Critical Vulnerabilities

SAP’s January 2026 Security Updates patch 17 notes, four of which address critical-severity vulnerabilities, SecurityWeek reports. The first advisory resolves CVE-2026-0501 (CVSS 9.9), a SQL injection bug in S/4HANA tied to the ABAP Database Connectivity framework; Onapsis notes that exploitation could allow an attacker to execute arbitrary SQL and fully compromise the system.

The second critical flaw, CVE-2026-0500 (CVSS 9.6), is a remote code execution issue in Wily Introscope Enterprise Manager, where unauthenticated attackers can craft malicious JNLP files accessed via URLs. The third, CVE-2026-0498 (CVSS 9.1), is a code injection vulnerability in S/4HANA enabling OS command injection and potential full compromise.

The fourth, CVE-2026-0491 (CVSS 9.1), is a code injection defect in Landscape Transformation; Onapsis describes the affected component as shipped as a separate DMIS add-on. The remaining nine notes patch medium- and low-severity flaws across ERP Central Component, S/4HANA, NetWeaver and related components, and organisations are urged to review and apply the patches promptly as vulnerable SAP applications are attractive targets for threat actors.