SAP’s June 2026 Patch Day: Why Improper RFC Validation Must Be Treated as a Breach Scenario

Dr. Sarah Chen breaks down what you need to know

If you’ve spent any time securing S/4HANA landscapes, you’ll recognise the uneasy rhythm of SAP Patch Day: a new batch of Security Notes, a scramble to triage, and the subtle pressure to “just get them applied” so the audit finding turns green. But the June 2026 cycle is different. Among the 20 patches, six vulnerabilities directly involve improper RFC validation — and one of those, if left unaddressed, hands an attacker the same keys your trusted internal systems use every day. This isn’t a theoretical concern. I’ve seen entire production landscapes compromised through a single misconfigured gateway. Here’s what’s really at stake and what you must do beyond the patch itself.

The Real Story

SAP’s June 2026 Security Notes cover a range of CVSS scores, but the spotlight falls on those targeting RFC gateway processing. Improper validation here means an unauthenticated or low-privileged user can call certain RFC-enabled function modules without proper authorization checks, potentially executing operating system commands, reading sensitive table data, or pivoting to other systems. In one note, the vulnerability allows an attacker to register a malicious program ID with the gateway and intercept or reroute trusted RFC traffic — a classic man-in-the-middle technique that my incident response cases have repeatedly shown is devastating in highly integrated landscapes.

Why does this keep happening? Because the RFC gateway, by design, is a trust broker. It relies heavily on configuration (secinfo, reg_info, prxyinfo) and disciplined ABAP coding. Many organisations run these files with * wildcards to “avoid breaking things,” inadvertently opening broad access. The patch fixes a specific flaw in the gateway’s handling of program registration or function module dispatch, but it does not rewrite your configuration. That’s the gap practitioners miss.

The Onapsis analysis (linked below) details one vulnerability where an attacker could craft a special RFC call to a gateway with insufficient input validation, bypassing the usual ACL. While the CVSS base score might read 8.2 or 9.1, the true exploitability in a real SAP landscape — with complex interconnected Satellite systems, Gateway hubs, and Cloud Connectors — is often higher than the score suggests. I’ve learned to treat any RFC validation finding as a “patch immediately and then hunt” event.

What This Means for You

For Basis teams:
You’re on point for deploying the kernel and gateway patches. But your real task starts after the transport imports: immediately validate that your gateway security files aren’t still wide open. I’ve seen too many post-patch reviews where reg_info still accepts any external program. Use transaction SMGW → Goto → Expert Functions → External Security to check loaded rules. If you see a line like TP=* HOST=* CANCEL=* and you don’t absolutely need it, you’re still vulnerable.

For ABAP developers:
These patches don’t touch your custom RFC interfaces. Every Z-function module that is RFC-enabled and lacks an explicit AUTHORITY-CHECK or has a DESTINATION parameter glued to a hardcoded credential remains a pathway for post-patch exploitation. I recommend running a quick scan on your development system right now:

SELECT funcname, global_flag, remote_basxml
  FROM tfdir
  INTO TABLE @DATA(lt_rfc_modules)
  WHERE fmode = 'R'
    AND ( authck EQ space OR authck IS NULL )
    AND unicode EQ 'X'.

Any function module returned by this query that handles sensitive data or OS commands needs immediate remediation. This morning query often yields dozens of candidates in legacy systems — don’t wait for an incident.

For security consultants / auditors:
Correlate the patched notes with your existing RFC interface inventory. If you’re using a tool like Onapsis or SAP Solution Manager’s custom code management, filter for all invocations of the affected function groups. Next, review user authorizations: S_RFC profiles that allow ACTVT = 16 (Execute) on function groups you can’t justify should be revoked. In my engagements, I’ve often found that patching triggers a false sense of completion; the real security posture improvement comes from the authorization hygiene that follows.

Action Items

1. Triage the notes immediately
   Prioritize any note with “RFC” or “gateway” in the title, especially those with CVSS ≥ 9.0. Apply them to a sandbox or development system first, then verify no critical business RFC calls break. Record baseline execution times for key interfaces (IDoc inbound, PI/PO messages) before the patch for comparison.

2. Harden gateway configuration post-patch
   After confirming the patch doesn’t break anything, edit reg_info to replace wildcards with explicit program IDs and allowed hosts. For a typical production gateway, a hardened rule might look like:

   TP=sapgw00 HOST=internal_trusted_host CANCEL=internal_trusted_host NO=1
   TP=* HOST=* CANCEL=* NO=0
   

   Adjust the DENY rule (NO=0) to explicitly block everything you haven’t allowed.

3. Review custom code for RFC gaps
   Run the TFDIR scan above and prioritize function modules that start with Z_ or Y_. For any that lack AUTHORITY-CHECK, add a check against an authorization object like ZRFC_AUTH or the standard S_RFC. If the function performs OS commands via SXPG_COMMAND_EXECUTE, ensure the external command is defined with OS user context, not just *.

4. Test against real attack scenarios
   In your sandbox, attempt an external RFC call using a simple Python script with the pyrfc library. Try to invoke a known sensitive function without proper credentials. This “assumed breach” test will quickly reveal whether your configuration gaps still allow bypass after the patch. Document the results for your change advisory board — it’s the most compelling evidence that additional hardening is needed.

5. Correlate with existing security monitoring
   If you have SAP Enterprise Threat Detection or a SIEM connector, set alerts for any RFC gateway registration event from unexpected hosts or for failed authorization checks on high-risk function modules. Many attacks will be noisy at the gateway level; catching them after patching validates that the patch worked as intended.

Community Perspective

In recent conversations with fellow SAP architects,

References

• SAP Security Notes: June 2026 Patch Day
• SAP Security Notes & News
• ABAP Development Guide

References

• ABAP Development Guide
• SAP Security Notes: June 2026 Patch Day
• SAP Security Notes & News