SAP May 2026 Patch Day Fixes Critical S/4HANA SQL Injection (CVE-2026-34260, CVSS 9.6) and NetWeaver XSS

SAP released its May 2026 Security Patch Day on May 12, 2026, publishing 17 new and updated Security Notes, including three HotNews notes and one High Priority note. The most severe issue, CVE-2026-34260, is a SQL-injection vulnerability in the SAP Enterprise Search component for ABAP (relevant to S/4HANA), rated CVSS 9.6: an authenticated attacker can inject malicious SQL through user-controlled input due to improper validation, enabling unauthorized database queries; Onapsis notes that in this case only read access is available, limiting integrity impact but still exposing sensitive business records.

SAP also addressed CVE-2026-27682, a reflected cross-site-scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP Business Server Pages applications (CVSS 4.7), where an unencoded URL parameter lets an attacker embed a malicious script that executes if a victim clicks a manipulated link, allowing the attacker to read or modify information in the victim's session. Additional fixes included CVE-2026-40135 (CVSS 6.5), an OS-command-injection issue in NetWeaver AS for ABAP and ABAP Platform.

SAP and Onapsis indicated these were proactive patches with no confirmation of in-the-wild exploitation at release. Given SAP's central role in enterprise resource planning and the recurring targeting of NetWeaver in prior years, researchers urged immediate application of the patches, particularly for the maximum-business-risk S/4HANA SQL-injection flaw.