SAP Note 3255746: The Looming ODP-RFC Deadline and Practical Migration Steps

Arjun Mehta breaks down what you need to know

If you rely on ODP data extraction from an SAP source system into BW, Data Services, or any third-party ETL tool, there’s a security patch coming that will silently break your data pipelines. SAP Note 3255746 may look like just another note in the endless stream, but its enforcement by June 2026 will block all legacy, unsecured ODP-RFC calls. I’ve spent 25 years working with SAP integrations, from classic R/3 extractors to modern CDS-based ODP, and I’ve seen security patches catch even well-run teams off guard. This one is different because it touches the very backbone of many existing extraction architectures.

The Real Story

Back in the early 2000s, when I was an ABAP developer at Infosys, we configured ODP (then called “ODP SAPI”) over RFC destinations without a second thought. The pattern was simple: a BW system (or ETL tool) would call function modules like RSA1_OLTPSOURCE_GET_DATA or RSA1_OLTPSOURCE_GET_LIST directly over an unauthenticated RFC connection. It worked, and it worked fast. Fast-forward two decades, and SAP is finally pulling the plug on that insecure legacy behavior.

SAP Note 3255746, originally released in 2022 with additional updates, enforces that ODP data extraction via RFC must use secure communication (like SNC, strict authentication, and proper authorization checks). Non-compliant RFC calls will be rejected. The patch responsible for this enforcement has already been delivered via support packages and will become mandatory with a security note targeted for June 2026. After that date, if your RFC destination doesn’t meet the new standards, extraction will fail—sometimes with a cryptic error like “No authorization for ODP extraction” or an RFC communication failure.

What’s really happening under the hood? The ODP framework now checks whether the calling context is one of the approved, secure patterns. The old, raw RFC call from an external tool without SNC or without the user having proper S_RFC or S_ODP authorization gets rejected. This isn’t just a minor tweak; it’s a hard break for many legacy landscapes.

What This Means for You

If you’re reading this, you probably have at least one (and likely many) ODP-RFC connections in your landscape. Here’s how it impacts different roles:

• Developers: Custom ABAP programs calling ODP extractors directly via RFC will stop working. Even routine calls inside BW process chains might break if the underlying connection uses an old-style RFC destination. For example, a data source in BW 7.5 that pulls from S/4HANA via RFC without SNC will simply stop delivering data.
• Basis & Security Teams: You’ll need to retrofit existing RFC destinations with SNC or migrate them to HTTPS-based protocols. Every RFC destination of type ‘3’ (ABAP connection) pointing to an ODP-enabled source must be audited. Additionally, you’ll have to adjust firewall rules and maintain the new authorization objects S_ODP (for ODP context checks) alongside classic S_RFCACL.
• Architects: The most sustainable path is to move ODP extractions away from RFC entirely—toward OData-based ODP (sap/opu/odata/odp) or CDS view extraction. That’s a migration project, not a quick fix. Existing third-party ETL tools (Informatica, Talend, even SAP Data Services) may need connector updates or reconfigurations.
• Managers: You need to budget time and resources now. In my consulting practice, I’ve already seen clients underestimate the scope. A single large enterprise can have

References

• SAP Note 3255746: The June 2026 Deadline That Could Break Your SAP Data Pipelines
• SAP Note 3255746: The June 2026 Deadline That Could Break Your SAP Data Pipelines- SAP Security Notes & News

References

• SAP Note 3255746: The June 2026 Deadline That Could Break Your SAP Data Pipelines
• SAP Note 3255746: The June 2026 Deadline That Could Break Your SAP Data Pipelines
• SAP Security Notes & News