SAP Security Notes April 2026: Critical SQL Injection and High-Risk Flaws Patched
SAP’s April 2026 security update addresses a critical SQL injection vulnerability in SAP Business Planning and Consolidation and SAP Business Warehouse. This top-priority issue, detailed in Hot News note 3719353, stems from insufficient authorization checks and is fixed by deactivating the vulnerable code. Other high-risk patches were also released. The April 2026 SAP Security Patch […]
How to Deploy the Cybersecurity Extension for SAP on SAP Build Work Zone
Deploying the Cybersecurity Extension for SAP on SAP BTP involves a three-stage process that takes approximately 45 minutes. First, prepare the SAP BTP subaccount, ensuring the Cloud Connector, destinations, and entitlements are correctly configured. Next, use the Cloud Foundry CLI to deploy the provided .mtar file. Finally, configure SAP Build Work Zone by importing the […]
Layer Seven Security Achieves CyberSecure Canada Certification
Layer Seven Security has successfully achieved certification under the CyberSecure Canada program, validating its strong cybersecurity posture and the application of recognized baseline security controls. This certification provides customers, especially those who rely on SAP systems, with independent assurance that Layer Seven Security operates within a structured and nationally recognized cybersecurity framework. This certification reinforces […]
SAP Security Notes March 2026: Critical Log4j and RCE Flaws Patched
SAP’s security notes for March 2026 address 14 vulnerabilities, including two critical “Hot News” items. The most severe patches fix a command injection vulnerability related to Apache Log4j and a remote code execution flaw in SAP NetWeaver Enterprise Portal. A high-risk Denial of Service (DoS) note for SAP Supply Chain Management was also released. This […]
State-Sponsored Cyber Attacks on SAP: A Guide to Threats and Defenses
State-sponsored cyber attacks are a rapidly increasing threat to SAP solutions, driven by rising geopolitical tensions. Attackers target mission-critical SAP systems for espionage and sabotage, exploiting their wide attack surface and slow enterprise patching cycles. Defending these vital systems requires specialized vulnerability management, real-time threat detection, and a focused effort to harden specific SAP configurations […]
SAP Security Notes February 2026: Critical Code Injection and Authentication Flaws
SAP’s February 2026 security update addresses several critical vulnerabilities, including a code injection flaw in SAP S/4HANA and SAP CRM, and a missing authentication check in SAP NetWeaver AS ABAP. These “Hot News” notes require immediate attention to prevent potential system compromise and unauthorized data access. The February 2026 SAP Security Notes patch day released […]
Digital Operational Resilience Act (DORA) Compliance for SAP Solutions
The Digital Operational Resilience Act (DORA) is an EU regulation that requires financial institutions to ensure their Information and Communications Technology (ICT) systems can withstand, respond to, and recover from disruptions. For organizations using SAP for critical functions, this means SAP solutions must be governed, monitored, and tested to meet DORA’s stringent standards for operational […]
SAP Security Notes January 2026: Critical Vulnerabilities in S/4HANA and More
SAP’s January 2026 security update addresses several critical vulnerabilities, including a SQL injection and a code injection backdoor in S/4HANA that could lead to full system compromise. Immediate patching is required to mitigate risks of data theft, modification, and remote code execution across key SAP products. This advisory summarizes the most severe vulnerabilities released on […]
What Are the Key Security Risks in RISE with SAP? Findings from the 2025 Benchmark Report
The SAPinsider RISE with SAP 2025 benchmark report reveals a critical security gap: widespread customer non-compliance with the shared responsibility model. The most significant failure is not implementing SAP’s mandatory security hardening requirements, leaving cloud ERP systems vulnerable and exposing organizations to significant operational, legal, and and reputational risk. The report, based on a survey of 122 […]
SAP Security Notes December 2025: Analysis of Critical Patches
SAP’s December 2025 security update includes three “Hot News” notes that patch critical vulnerabilities. These address a code injection flaw in SAP Solution Manager (SolMan), a deserialization vulnerability in SAP jConnect, and multiple issues in Apache Tomcat within SAP Commerce Cloud. Organizations should prioritize applying these patches to mitigate the risk of exploitation. This advisory […]