Advisory
On 14.07.2026 a security relevant correction has been released by SAP SE. The manufacturer resolves an issue within SAP Edge Integration.
SAP Note 3758101 addresses "3758101 - [CVE-2026-40860] Multiple vulnerabilities in Apache Camel within SAP Integration Suite (Edge Integration Cell)" to prevent insecure deserialization with a high risk for exploitation.
A workaround does exist, according to SAP Security Advisory team. It is advisable to implement the correction as monthly patch process, the team suggests.
Risk specification
SAP Integration Suite (Edge Integration Cell) allows an authenticated attacker to send specially crafted headers or objects that exploit unsafe deserialization, potentially resulting in arbitrary code execution.
Solution
A safelist of permitted classes for deserialization has been implemented, preventing unauthorized or malicious classes from being deserialized and executed on the server. Circumstances exist that prevent the timely installation of a patch provided by the manufacturer. In such cases, you may consider applying the suggested workaround as a temporary or compensating mitigation: "Avoiding the use of the AMQP sender adapter with SAP Integration Suite Edge Integration Cell; if the adapter is required, enforcing strict access controls on the broker and queue to prevent injection of specially crafted messages.".
