SAP Security Patch Day – Critical SAP CRM and SAP S/4HANA Code Injection Vulnerabilities Fixed

SAP's February 2026 Security Patch Day released 26 new security notes (plus one update) addressing multiple vulnerabilities across SAP products, with the most severe being CVE-2026-0488 (code injection, CVSS 9.9) in SAP CRM and S/4HANA and CVE-2026-0509 (missing authorization, CVSS 9.6) in NetWeaver; the bulletin emphasizes prompt patching to mitigate high-impact risks such as unauthorized code execution, authorization bypass, XML signature manipulation, and denial-of-service.