SAP Releases Patch for Critical SQL Injection Flaw in S/4HANA

On May 12, 2026 SAP published a monthly security update fixing 15 vulnerabilities across its ecosystem — most notably CVE-2026-34260 (critical SQL injection in Enterprise Search for ABAP, CVSS 9.6) and CVE-2026-34263 (critical missing authentication in Commerce Cloud, CVSS 9.6). The advisory also addresses a high-severity OS command injection and multiple medium/low issues across NetWeaver, BusinessObjects, HANA HDI, and other components; organizations are urged to apply patches immediately to prevent data theft and remote compromise.