SAP Patches Critical Code Injection, Memory Corruption Vulnerabilities

SAP's August 2026 Patch Day, rolled up by the Canadian Centre for Cyber Security as advisory AV26-798 dated August 11, 2026, fixes critical code injection and memory corruption flaws across the core estate: NetWeaver and ABAP Platform kernels (KRNL64NUC and KRNL64UC lines 7.22 through 9.19, KERNEL 7.22 through 9.19), ABAP Developer Tools and BusinessObjects BI Platform Central Management Server on SAP_BASIS 750 through 920 plus BusinessObjects ENTERPRISE 430, 2025 and 2027, Manufacturing Integration and Intelligence 15.4 and 15.5, Commerce Cloud COM_CLOUD, OM_CLOUD and DHUB_CLOUD 2211 builds, and the Change and Transport System Attach Tool (ctsattach, CTS_UPLOAD_CLT 1). The same week carries two more code-injection fixes that belong to the same class: GitLab shipped a critical code injection patch on August 18, and CISA added CVE-2025-62593, a code injection flaw in the Ray distributed computing framework, to the KEV catalog on 2026-08-17 with exploitation confirmed in the wild.

The argument is about velocity, not novelty. CVE-2025-62593 is a 2025-numbered CVE that only entered KEV in August 2026, and the federal remediation deadline is 2026-08-20, three days after listing, with a forensic triage flag attached; that is a response window measured in days for a vulnerability that has existed for the better part of a year. The KEV record pairs CWE-94 with CWE-352, a cross-site request forgery path leading into code execution, which is why the entry's description calls out reachability through Firefox and Safari for developers running Ray as a development tool. Ray underpins AI, machine learning and data-processing workloads, so the exposed population is cloud and lab estates that rarely sit inside corporate patch SLAs. On the SAP side, the kernel version spread from 7.22 to 9.19 means a decade of landscapes is in scope, ctsattach is precisely the niche transport component that persists unpatched in real systems, and the BusinessObjects Central Management Server is the tier that holds BI credentials and audit state. One patch day now moves enterprises and ML infrastructure on the same clock, and the thirty other stories that day did not carry an actively exploited entry with a three-day deadline.

For defenders, the actions are concrete. Apply the August 2026 SAP security notes from SAP's Patch Day page on support.sap.com and inventory every system against the advisory's version lines, giving priority to internet-facing NetWeaver kernels, the ctsattach component, and BusinessObjects CMS deployments on ENTERPRISE 430, 2025 or 2027. For Ray, apply the vendor fix in advisory GHSA-q279-jhrf-cc6v, which lands in commit 70e7c72780bdec075dba6cad1afe0832772bfe09, and treat internet-exposed Ray instances as triage candidates per CISA's BOD 26-04 guidance cited in the KEV required action, since the entry asserts active exploitation. For GitLab, upgrade to the release carrying the August 18 critical code injection fix and check the release notes for severity and exploitation language.

Two developments would change this assessment. A KEV listing or credible exploitation telemetry naming a specific SAP note from this rollup would convert a maintenance event into an incident priority, so watch CISA and SAP alerts over the next two weeks. Second, watch whether the GitLab flaw is confirmed exploited or gets public proof-of-concept code, and whether Ray scanning appears beyond the current KEV entry, which would signal the usual KEV-to-mass-scan escalation.