SQL injection

January 2026 Security Patch Day addresses 19 vulnerabilities including CVE-2026-0501, a critical SQL injection in S/4HANA's General Ledger that enables full system compromise through arbitrary SQL execution.

The Cl0p ransomware group exploited a zero-day vulnerability in Progress Software's MOVEit Transfer, compromising over 2,700 organizations and exposing data of 95+ million individuals in one of the largest mass exploitation events ever.