Risk
Unapplied fixes leave known vulnerabilities exposed even when system settings are correct.
ABAPJavaHANASAP GUIBTP
Settings and priorities
| Technology / priority | Parameter or mechanism | Setting and purpose |
|---|---|---|
| ABAP Critical | SAP_BASIS, kernel, CommonCryptoLib | Update at least annually Separate from timely handling of security fixes. |
| Java Critical | Java components, kernel, CommonCryptoLib | Update at least annually Include all system components. |
| HANA Critical | HANA database revision | Update at least annually Use a controlled revision and testing cycle. |
| SAP GUI Critical | SAP GUI and SAP Business Client | Update at least annually Cover all client installations. |
| ABAP Critical | SAP Security Notes | Review and implement promptly Document any decision not to implement. |
| Java Critical | SAP Security Notes | Review and implement promptly Assess affected Java components separately. |
| HANA Critical | SAP Security Notes | Review and implement promptly Prioritize according to applicability and exposure. |
| BTP Standard | Cloud Connector | Current version Maintain the integration component. |
How to verify
- Define owners for review, testing and deployment.
- Maintain an inventory of component versions.
- Review security fixes continuously, not only during the annual upgrade.
- Document exceptions and verify deployment effectiveness.