SAP May 2026 patch day expands risk across ABAP, commerce and CI/CD

At a glance

What this is: Pathlock’s analysis of SAP’s May 2026 Patch Day says the month’s highest-priority issues span SQL injection, unauthenticated configuration upload, command injection, and a malicious NPM supply chain advisory.

Why it matters: For SAP, IAM, and DevOps teams, the key lesson is that patch management alone is not enough when privileged access, exposed configuration paths, and build pipelines all sit inside the attack surface.

By the numbers:

• SAP released 16 Security Notes in its May 2026 Patch Day.

Context

SAP’s May 2026 Patch Day is not just a list of application defects. It is a reminder that SAP risk spans search inputs, commerce configuration paths, administrative execution surfaces, and developer build chains, each of which can become an access or code-execution problem when governance is weak.

The governance gap is that many teams still treat SAP patching as a Basis-only exercise. In practice, the attack surface now crosses ABAP, Commerce Cloud, CI/CD, and privileged technical users, which means remediation decisions have to include access scope, secret exposure, and deployment hygiene.

The month’s most important pattern is that exploitation often begins with authenticated or indirect access rather than a clean external break-in. That changes how identity teams, security operations, and application owners should think about exposure, blast radius, and recovery readiness.

Key questions

Q: What breaks when SAP configuration upload paths are left reachable without proper authentication?

A: Unauthenticated or weakly protected configuration upload paths turn an administrative function into an execution surface. In Commerce Cloud, that can let an attacker stage malicious content for later processing, which may lead to server-side code execution. The control failure is not the upload itself but the absence of reliable authentication and authorization at the entry point.

Q: Why do over-privileged SAP accounts increase breach and fraud risk?

A: Over-privileged SAP accounts expand the damage a compromised user can do because they give access beyond job need. That increases the chance of unauthorized data exposure, unauthorized changes, and fraud, while also making audits harder. When standing privileges accumulate over time, least privilege and Zero Trust assumptions weaken, and attackers need only one exposed account to reach critical business processes.

Q: What are the signs that SAP build systems may have been exposed to malicious packages?

A: Look for unexplained cache changes, new workflow files, suspicious branches or commits, unusual package versions, and secrets that appear in places they should not be reachable from. If a developer workstation or CI/CD runner installed a compromised package, assume reachable credentials and repositories may need review.

Q: When should teams prioritise supply chain review over routine patching in SAP environments?

A: Prioritise supply chain review when affected package versions may already have been installed on developer machines or build runners, because then the issue is not only a vulnerability but a possible incident. In that case, cache cleanup, secret rotation, repository inspection, and environment isolation become as important as updating the package.

Technical breakdown

SQL injection in S/4HANA Enterprise Search

Enterprise Search is a sensitive query layer because user input is translated into database activity. In this case, the flaw is classic SQL injection: attacker-controlled text is concatenated into SQL without proper validation or sanitisation, so the database executes unintended commands. The impact is not limited to data theft. A search function that reaches core business records can also destabilise the application and create operational disruption. In SAP environments, that makes input handling part of data protection, not just appsec hygiene.

Practical implication: treat high-value search interfaces as database-adjacent controls and validate that patching removes unsafe query construction.

Missing authentication in Commerce Cloud configuration upload

The Commerce Cloud issue is less about a bad upload feature and more about broken access control around a configuration path. Improper Spring Security rule ordering or overly permissive rules can leave sensitive upload functionality reachable without authentication, allowing malicious content to be staged for server-side execution. Once configuration data is processed by a legitimate workflow, the result can become arbitrary code execution on the server. That is why unauthenticated exposure of admin-adjacent paths is so dangerous in customer-facing commerce systems.

Practical implication: verify that configuration upload paths are behind the correct authentication and authorization rules before they can be reached.

Malicious NPM packages in SAP CAP and MTA Build Tool workflows

The package advisory is a supply chain problem, not a traditional application bug. Malicious packages can execute during install, access local developer material, and propagate through caches, lockfiles, or build runners into downstream repositories and environments. In SAP development contexts, that can mean secrets theft, unauthorized workflow changes, and contamination of CI/CD outputs. The governance issue is that build pipelines often inherit trust from the package ecosystem without enough verification of provenance, version pinning, and environment isolation.

Practical implication: audit build systems for package provenance, cache contamination, and secret exposure before trusting downstream artifacts.

Threat narrative

Attacker objective: The attacker’s objective is to turn trusted SAP application, commerce, or build functionality into code execution, data exposure, or downstream environment compromise.

1. Entry begins when an attacker reaches a vulnerable SAP search, commerce, or build workflow surface through normal application access or a poisoned package installation.
2. Credential or access abuse follows when low-privileged authenticated users, unauthenticated configuration paths, or infected build environments provide a usable execution path.
3. Escalation occurs when SQL injection, server-side code execution, command injection, or malicious package behaviour turns that access into broader system control or secret exposure.
4. Impact is the exposure of sensitive business data, disruption of commerce or forecasting operations, or contamination of developer and CI/CD environments with stolen secrets and malicious artefacts.

Breaches seen in the wild

• Nx s1ngularity attack 2025: Attackers stole Nx's npm token via a GitHub Actions flaw and shipped malware that stole 2,349 secrets and abused developers' AI CLIs.
• LiteLLM PyPI package breach: LiteLLM PyPI supply chain attack, credentials stolen from users.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity boundaries are now part of SAP patch management: This month’s notes show that SAP risk is not confined to software defects; it is also shaped by who can reach privileged functions, configuration paths, and build systems. When authenticated access, unauthenticated upload paths, and developer tooling all sit in the same patch cycle, teams have to govern privilege and exposure as part of remediation. The practitioner conclusion is that patching, access review, and deployment control are now one operational problem.

Supply chain controls have become SAP security controls: The malicious NPM advisory matters because a development dependency can become an identity event when it touches secrets, repositories, or CI/CD credentials. That is a governance shift, not just an incident response issue. Build environments that can reach tokens, SSH keys, or cloud credentials need the same scrutiny as production admin paths, and that is exactly where NHI governance now intersects software delivery.

Overprivileged technical access remains the recurring failure mode: The command injection and configuration upload issues both reward trusted access paths that were not constrained tightly enough. This is the same governance problem across ABAP, Commerce Cloud, and forecasting tools: administrative reach is broader than operational necessity. The practitioner conclusion is that SAP estates still need tighter separation of duties, smaller execution scopes, and better control over privileged technical users.

Blast radius now extends beyond the SAP runtime: The article’s supply chain and execution-path findings show that compromise can move from SAP application logic into developer laptops, package caches, and CI/CD runners. That widens the identity perimeter materially. The practitioner conclusion is that SAP security teams should measure impact by reachable secrets and executable trust, not just by component severity.

Patch severity is no longer a reliable proxy for operational risk: A note with a CVSS 0.0 score can still be operationally critical if malicious packages touched build systems that store credentials. That is why severity scoring alone misses the governance problem. The practitioner conclusion is to rank SAP exposure by where trust, secrets, and execution rights intersect, not by score alone.

From our research library:

• Breaches involving third parties rose to 48% of all breaches, a 60% increase on the previous year, according to Verizon's 2026 Data Breach Investigations Report.
• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
• Read next: AI Supply Chain Security and AI-BOM Guide

What this signals

Supply-chain trust now sits inside SAP identity governance: When a malicious package can reach developer tokens, SSH keys, or cloud credentials, the question is no longer only whether the package is patched. The governance problem is whether build systems are allowed to inherit trust from sources that can silently change execution and secret exposure paths. Practitioners should treat CI/CD runners as privileged non-human identities and govern them accordingly.

Attack surface review has to include configuration and execution pathways: SAP patch notes increasingly touch input handling, admin-adjacent upload functions, and command execution paths, which means the real exposure is often the path that crosses from data entry into system action. Identity teams should work with app owners to identify where authentication, authorization, and runtime privilege collide, then reduce those overlaps before the next patch cycle.

92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs. That figure is a reminder that third-party reach is not a side issue. In SAP environments, developer tooling, package registries, and external support relationships can all widen the same trust boundary.

For practitioners

• Prioritise patching of internet-reachable SAP attack paths Focus first on S/4HANA Enterprise Search, Commerce Cloud configuration upload paths, and any external-facing SAP functions that allow low-friction access to sensitive data or execution.
• Review privileged SAP accounts and technical users Inventory administrative and technical access across ABAP, Commerce Cloud, forecasting, and build systems, then verify that each account has only the execution scope it actually needs.
• Isolate developer and CI/CD environments from production secrets Treat CAP and MTA Build Tool workstations and runners as secret-bearing assets, with cache cleanup, exact version pinning, repository review, and secret rotation after exposure.
• Monitor for abnormal SQL, process, and workflow behaviour Watch for malformed search input, unexpected OS command execution, suspicious configuration uploads, and unexplained package or workflow changes in build systems.
• Separate SAP security ownership across Basis, DevOps, and IAM Assign clear responsibility for patch deployment, privileged access review, and software supply chain hygiene so that remediation does not stop at installing notes.

Key takeaways

• SAP’s May 2026 Patch Day shows that SAP risk now spans application logic, administrative execution paths, and software supply chains rather than one product layer.
• The most urgent issues include critical SQL injection in S/4HANA Enterprise Search, a Commerce Cloud authentication gap, and malicious NPM packages that can expose developer secrets.
• Teams should respond by combining patching with privileged access review, secret rotation, build-system isolation, and tighter control over SAP-adjacent execution paths.

Key terms

• Enterprise Search Attack Surface: The set of search interfaces, query handlers, and backend paths that can be abused when user input reaches business data stores. In SAP environments, it becomes security-sensitive because search is often close to core records and may expose or disrupt information if validation is weak.
• Configuration Upload Path: A workflow or endpoint that accepts configuration data and applies it to a running system. When authentication or authorization is misconfigured, that path can become a code execution route because benign-looking uploads are processed by privileged application logic.
• Software Supply Chain Exposure: Software supply chain exposure is the risk that a trusted software component, update, dependency, build step, or delivery path can be altered or abused before it reaches production. It includes compromised code, poisoned packages, insecure CI/CD, stolen signing keys, and tampered artifacts that can introduce hidden access, malware, or data loss.
• Privilege Blast Radius: The amount of damage an attacker can do after compromising a privileged identity. It is a more useful operational measure than simple account counts because it reflects how far access can spread across cloud, SaaS, and machine identities once a control path is abused.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.