{"$ref":"https://www.cert.ssi.gouv.fr/openapi.json","affected_systems":[{"description":"Business Objects versions ENTERPRISE 430, 2025 et 2027 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"BusinessObjects","vendor":{"name":"SAP","scada":false}}},{"description":"MDG (Review Match Groups Application) versions S4CORE 108, SAP_BASIS 916, SAP_BASIS 917 et SAP_ABA 816 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"N/A","vendor":{"name":"SAP","scada":false}}},{"description":"NetWeaver AS ABAP and ABAP Platform versions SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, SAP_BASIS 816, SAP_BASIS 918 et SAP_BASIS 919 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"NetWeaver","vendor":{"name":"SAP","scada":false}}},{"description":"NetWeaver AS ABAP and ABAP Platform versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 722EXT, 7.53, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 9.16, 9.18 et 91.9 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"NetWeaver","vendor":{"name":"SAP","scada":false}}},{"description":"ODP Data Replication APIs versions DW4CORE 200, 300, 400, PI_BASIS 2006_1_700, 701, 702, 731, 740, SAP_BW 750 et 816 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"N/A","vendor":{"name":"SAP","scada":false}}},{"description":"NetWeaver AS ABAP and ABAP Platform versions SAP_BASIS 700, SAP_BASIS 701, SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754, SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758 et SAP_BASIS 816 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"NetWeaver","vendor":{"name":"SAP","scada":false}}},{"description":"Business Objects Business Intelligence Platform versions ENTERPRISE 430, 2025 et 2027 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"BusinessObjects","vendor":{"name":"SAP","scada":false}}},{"description":"NetWeaver AS Java (JDBC Test Servlet) version BI_UDI 7.50 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"NetWeaver","vendor":{"name":"SAP","scada":false}}},{"description":"NetWeaver Application Server Java (Web Container) version ENGINEAPI 7.50 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"NetWeaver","vendor":{"name":"SAP","scada":false}}},{"description":"Commerce Cloud and Data Hub versions HY_COM 2205, HY_DHUB 2205, COM_CLOUD 2211, 2211-JDK21 et DHUB_CLOUD 2211 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"Commerce Cloud","vendor":{"name":"SAP","scada":false}}},{"description":"Commerce Cloud versions HY_COM 2205, COM_CLOUD 2211 et 2211-JDK21 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"Commerce Cloud","vendor":{"name":"SAP","scada":false}}},{"description":"Fiori (launchpad) versions SAP_UI 754, 755, 756, 757, 758 et 816 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"N/A","vendor":{"name":"SAP","scada":false}}},{"description":"Wily Introscope Enterprise Manager version WILY_INTRO_ENTERPRISE 10.8 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"N/A","vendor":{"name":"SAP","scada":false}}},{"description":"NetWeaver AS Java versions SERVERCORE 7.50, CORE-TOOLS 7.50 et J2EE-APPS 7.50 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"NetWeaver","vendor":{"name":"SAP","scada":false}}},{"description":"S/4HANA versions S4FND 102, 103, 104, 105, 106, 107, 108 et 109 sans le dernier correctif de s\u00e9curit\u00e9","product":{"name":"S/4HANA","vendor":{"name":"SAP","scada":false}}}],"affected_systems_content":"","content":"## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l'\u00e9diteur pour l'obtention des correctifs (cf. section Documentation).","cves":[{"name":"CVE-2026-44746","url":"https://www.cve.org/CVERecord?id=CVE-2026-44746"},{"name":"CVE-2026-44750","url":"https://www.cve.org/CVERecord?id=CVE-2026-44750"},{"name":"CVE-2026-44743","url":"https://www.cve.org/CVERecord?id=CVE-2026-44743"},{"name":"CVE-2026-44755","url":"https://www.cve.org/CVERecord?id=CVE-2026-44755"},{"name":"CVE-2026-44754","url":"https://www.cve.org/CVERecord?id=CVE-2026-44754"},{"name":"CVE-2026-29145","url":"https://www.cve.org/CVERecord?id=CVE-2026-29145"},{"name":"CVE-2026-44751","url":"https://www.cve.org/CVERecord?id=CVE-2026-44751"},{"name":"CVE-2026-44757","url":"https://www.cve.org/CVERecord?id=CVE-2026-44757"},{"name":"CVE-2026-27671","url":"https://www.cve.org/CVERecord?id=CVE-2026-27671"},{"name":"CVE-2026-44744","url":"https://www.cve.org/CVERecord?id=CVE-2026-44744"},{"name":"CVE-2026-44748","url":"https://www.cve.org/CVERecord?id=CVE-2026-44748"},{"name":"CVE-2025-68161","url":"https://www.cve.org/CVERecord?id=CVE-2025-68161"},{"name":"CVE-2026-24315","url":"https://www.cve.org/CVERecord?id=CVE-2026-24315"},{"name":"CVE-2026-22732","url":"https://www.cve.org/CVERecord?id=CVE-2026-22732"},{"name":"CVE-2026-40128","url":"https://www.cve.org/CVERecord?id=CVE-2026-40128"}],"links":[],"reference":"CERTFR-2026-AVI-0715","revisions":[{"description":"Version initiale","revision_date":"2026-06-09T00:00:00.000000"}],"risks":[{"description":"Injection de code indirecte \u00e0 distance (XSS)"},{"description":"Injection SQL (SQLi)"},{"description":"Non sp\u00e9cifi\u00e9 par l'\u00e9diteur"},{"description":"Contournement de la politique de s\u00e9curit\u00e9"}],"summary":"De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits SAP. Certaines d'entre elles permettent \u00e0 un attaquant de provoquer une injection SQL (SQLi), une injection de code indirecte \u00e0 distance (XSS) et un contournement de la politique de s\u00e9curit\u00e9.","title":"Multiples vuln\u00e9rabilit\u00e9s dans les produits SAP","vendor_advisories":[{"published_at":"2026-06-09","title":"Bulletin de s\u00e9curit\u00e9 SAP june-2026","url":"https://support.sap.com/en/my-support/knowledge-base/security-notes-news/june-2026.html"}]}