SAP August 2026: A 10.0 Flaw (CVE-2026-58231) and No Japanese Advisory

SAP, the largest vendor of the business systems that run corporate finance, purchasing, inventory and HR, published its monthly security fixes on August 11, 2026. This month's batch includes one flaw rated 10.0, one rated 9.9, and one rated 9.8. The 10.0 and the 9.8 require no login at all.

The heavier of the two is the 9.8. The flaw sits in the foundation of the core business system, and there is no workaround. Fixing it means replacing the system's kernel, which will likely require taking the system down. This is not something you quietly apply overnight.

There is one more fact worth stating. As of August 12, nothing about this has appeared from Japan's JPCERT/CC, IPA, or JVN, and no Japanese security outlet has covered the August batch. For a product used by more than 2,000 companies in Japan alone, the Japanese-language record is completely empty.

What SAP actually runs

SAP is a German company that builds products for running an entire business on one system. It employs roughly 110,000 people. In its own words, it has spent more than 50 years integrating finance, procurement, HR, supply chain and customer experience — the operations a business cannot do without.

It is easier to grasp by asking what breaks. When SAP stops, documents cannot be raised, invoices cannot be issued, the monthly close does not progress. Warehouse stock counts stop updating and payroll loses its source data. Because the whole of a company's back office sits on one system, that system going down takes a wide range of work down simultaneously.

Adoption in Japan is substantial. The older generation, SAP ERP 6.0, is reportedly used by more than 2,000 companies in Japan, and those companies are currently in the middle of what the local industry calls the "2027 problem": mainstream support for that generation ends at the close of 2027, forcing a migration. These flaws landed in the middle of that migration, and they cover the old generation too.

The three that matter

Around thirty fixes shipped in total, but three deserve attention first. They are not ordered by severity score — they are ordered by whether a login is needed and by how much work the remediation is.

First priority: a hole in the foundation, with no workaround (CVE-2026-34265, 9.8)

The affected component is NetWeaver ABAP. The name may be unfamiliar, but this is SAP's heart. Finance, purchasing, inventory, HR — every business transaction runs on top of it. When an employee opens the SAP client, this is what it connects to.

The flaw is in the code that parses the proprietary protocol spoken between that client and the server. Send crafted data and memory handling breaks, leaking internal system information or crashing the system outright. No login is required.

What makes it awkward is the remediation. There is no workaround. The fix is a kernel replacement, which means the system will likely have to be taken down to apply it. Affected versions run from KERNEL 7.22 through 9.19 — an unusually wide range, so organizations still on the older generation are almost certainly in scope. For companies weighing a migration under the 2027 deadline, that is one more reason to move.

Rated 10.0: the seam between the storefront and the core (CVE-2026-58231)

By the numbers this is the month's largest at 10.0. The product is SAP Commerce Cloud — the platform companies use to build online stores, covering catalog, cart, orders, pricing and inventory integration. Formerly called hybris, it runs behind the e-commerce sites of large retailers and manufacturers.

Importantly, the flaw is not in the storefront itself. It sits in a component called the Data Hub Adapter, the connector that moves data between the store and the core business system — the pipe through which product master data and orders are pulled from the back end.

There, an attacker abuses an authentication client left in its default state and sends crafted input to a function with insufficient validation. On success they can execute arbitrary code and compromise internal components. No login is required. SAP's own scoring judged that the impact crosses the product's boundary, which is what pushes it to 10.0.

Affected builds are COM_CLOUD 2211 and 2211-JDK21. If the fix cannot be applied immediately, the interim measure is to restrict access to the affected endpoint by IP address. Permanently closing it requires taking the fix, rebuilding, and redeploying.

Rated 9.9: the link between the factory floor and the core (CVE-2026-44772)

The third is SAP MII, which acts as the bridge between equipment and production systems on the factory floor and the core business system at head office. Compromise here shows up as production figures not posting and stock counts drifting out of line.

The flaw lets an attacker slip commands into a data transformation step. Exploitation requires a low-privilege login, so the risk profile differs from the 10.0 and the 9.8. That said, MII accounted for six fixes this month (including one rated 9.1). For organizations running it, this is a month to work through the whole set.

Note that this 9.9 has not yet been published to the U.S. National Vulnerability Database as of August 12. The severity comes from SAP's own list and from the tallies of firms specializing in SAP security. Searching the identifier may return nothing, so it is worth saying up front.

The totals disagree depending on who is counting

There is a reason this article says "around thirty" rather than a precise figure. The counts differ by source.

SAP's own number is settled. What differs is how each firm counts: whether to include an external open-source advisory, whether to include updates issued mid-month, and whether to fold a prior month's revised note into this month. Those three choices produce a spread from 26 to 33.

In practice, the count does not change what you do. The only question is whether a product you run appears on the list. But readers comparing articles will hit conflicting numbers, so the disagreement is worth stating plainly.

Who goes after SAP, and what they take

The groups that target SAP are criminal crews that hold a company's core data for ransom, and state-sponsored attackers. This is not speculation. Both have happened to this product.

In 2025, a NetWeaver flaw (CVE-2025-31324, rated 10.0) was exploited in the wild. Logs covering 581 compromised systems were recovered, and the activity of multiple China-linked groups was confirmed. The ransomware crews BianLian, RansomEXX and Qilin used that hole as their way in. In September of the same year, exploitation was confirmed against the newer S/4HANA generation as well.

What they do once inside is extract the contents of the core system wholesale, then encrypt it to stop operations. What sits inside SAP is customer lists, supplier terms, cost data, payroll, inventory — the interior of the company itself. There is no data in there you would be relaxed about losing.

The damage splits by role. For suppliers and employees it means their information leaves the company. For the business it is a double loss: the data is taken and operations stop. Japan has seen this shape before, including a case where a core system outage stopped physical logistics.

This month's flaws are not being exploited yet

To be clear: as of August 12 there is no report of this month's vulnerabilities being used in real attacks. The firms specializing in SAP security all say the same.

We checked all 1,665 entries in CISA's catalog of vulnerabilities confirmed to be under attack. None of this month's SAP flaws appear.

That catalog does, however, contain 14 SAP entries from previous years, nine of them in NetWeaver — the same product that received the 9.8 this month. Commerce Cloud is in there too, added in 2019 — the same product that received the 10.0. "Not exploited yet" is not the same as "will not be exploited." Both of these products have a record.

Nothing exists in Japanese yet

The most striking feature of this month's batch is that no Japanese-language advisory exists at all. As checked on August 12:

This is not because the flaws are harmless. The Japanese-language ecosystem simply has not caught up. A Microsoft Patch Tuesday draws advisories from both JPCERT/CC and IPA the next day; SAP does not get the same treatment in Japan.

Which means "nobody in Japan is talking about it" is not a safety signal for this product. Organizations running SAP need to check the official notes themselves rather than wait for a local advisory.

Other fixes worth noting

Beyond the top three, a few items deserve mention.

Privilege escalation in the developer tooling (CVE-2026-58243, 8.8). Through the SQL console in the ABAP development tools, an attacker can reach privileges they should not have. This one does have an interim measure: tightening specific authorization objects.

Eleven CVEs fixed at once in the AI platform (CVE-2026-58230 and others, 7.0). A component used by SAP's AI-related platform had eleven CVEs addressed together. However, one analysis notes that the specified target version had not yet been released at the time of writing. If this applies to you, check availability first.

One clarification: the Commerce Cloud fixes include CVE-2026-42945 (8.1), which is not an SAP flaw. It is an existing vulnerability in the web server component (NGINX) that SAP bundles. Readers who encounter that identifier in another context should not treat it as new.

What to do now

Updating SAP is not "press update and you are done" the way Windows or WordPress is. Fixes are applied as individually numbered notes, and because this is a business system, they need testing. Sequence matters.

First, identify which products you actually run. SAP's portfolio is wide, and it is very unlikely all thirty items apply to you. NetWeaver ABAP applies to essentially anyone running SAP. Commerce Cloud applies if you operate an online store; MII applies if you have factories.

Second, plan the 9.8 kernel update. This is the longest job of the month. It cannot be deferred because there is no workaround, yet it may require downtime. Start by choosing the day you will take the system down. Reaching month-end without having picked that day is the worst outcome.

Third, if you run an online store, apply the interim measure for the 10.0 now. The permanent fix needs a rebuild and redeploy, but narrowing access to the affected endpoint by IP address can be done sooner. Better than leaving an unauthenticated hole open for several weeks.

Finally, confirm the division of responsibility with your integrator. Where SAP operations are outsourced, patching decisions frequently stall because nobody is sure whose job it is. With no local advisory circulating this month, the assumption that "we would have heard from them if it mattered" is especially dangerous.

Frequently asked questions

Summary

For SAP's August 2026 batch, the first thing to move on is the 9.8 in NetWeaver ABAP, the foundation of the core system. No login required, no workaround, and a fix that may require downtime. That combination is rare. The 10.0 in Commerce Cloud is higher by score, but once remediation effort is factored in, the 9.8 goes first — that is this article's call.

The good news is that none of this month's flaws are being exploited yet. The fixes are out and there is still time. But this product has a record: in 2025, 581 systems were compromised and several ransomware crews used the hole as their entry point. The option of moving before it starts only exists right now.

And there is still no Japanese-language advisory. Do not treat local silence as evidence of safety. This is a product used by more than 2,000 companies in Japan, in the middle of a forced migration. We will update this article as more emerges.

Sources

• ▸SAP - Security Patch Day August 2026 (official note list)
• ▸NVD - CVE-2026-58231 (Commerce Cloud, 10.0)
• ▸NVD - CVE-2026-34265 (NetWeaver ABAP, 9.8)
• ▸Onapsis - SAP Security Patch Day August 2026
• ▸SecurityBridge - SAP Security Patch Day August 2026
• ▸Pathlock - SAP Patch Day August 2026
• ▸SecurityWeek - SAP patches critical code injection, memory corruption vulnerabilities
• ▸CISA - Known Exploited Vulnerabilities Catalog
• ▸Onapsis - Active exploitation of CVE-2025-31324 (the 2025 precedent)
• ▸SecurityWeek - Ransomware groups and China-linked APTs exploiting SAP NetWeaver flaws
• ▸SAP - Company profile
• ▸Related: CISA KEV dashboard (this site)
• ▸Related: Oracle quarterly patch round-up (this site)