SAP released fixes for 15 security flaws in its June 2026 patch package, with four critical-severity vulnerabilities affecting NetWeaver and Commerce Cloud platforms.
SAP addressed the vulnerabilities through its monthly security update, prioritizing threats to two widely-used enterprise systems. NetWeaver and Commerce Cloud, which support critical business operations across numerous organizations, were the primary targets of the critical flaws.
The four critical-severity issues pose significant risk to affected deployments. Critical vulnerabilities in enterprise software can enable unauthorized access, data breaches, or system compromise if exploited. Organizations running these platforms should prioritize applying the patches.
The remaining 11 vulnerabilities in the patch package carry lower severity ratings. SAP's phased approach to security releases allows the company to address multiple threats across its product portfolio simultaneously.
NetWeaver serves as the foundation for many SAP applications, including ERP and CRM systems used by enterprises globally. Commerce Cloud supports e-commerce operations for retail and manufacturing organizations. Both platforms process sensitive business and customer data, making security updates critical.
SAP recommends customers review the security advisory for detailed information about each vulnerability, including affected versions and mitigation steps. Organizations should test patches in non-production environments before deploying to live systems.
The company typically releases security patches on the second Tuesday of each month. This structured schedule helps organizations plan maintenance windows and allocate resources for patch management.
Regular patching remains essential for maintaining enterprise security posture. Unpatched systems present ongoing risk from both known and emerging threats. Organizations should establish processes to deploy critical and high-severity patches promptly while managing operational requirements.
Ofcom has contacted Telegram seeking clarification on how the messaging app detects illegal incitement, after a Ukrainian man was convicted of arson attacks on property linked to UK Prime Minister Keir Starmer. The attacker was directed via the platform by a handler.
A New York man faces cyberstalking charges after allegedly creating and distributing AI-generated nude images of a Georgia college student. He also fabricated racist messages using fake social media profiles.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch a critical Splunk Enterprise vulnerability by Sunday due to active exploitation in the wild.
TeamPCP exploited fundamental weaknesses in open source software distribution to inject malware into over 1,000 packages. The breach exposed critical vulnerabilities in how the development community handles trust and security.