SAP fixed four security flaws that attackers could use without logging in. Older software versions may not get a fix.

SAP says two of the flaws could let an attacker who can reach the software over the network run their own programs on it. A third could let an attacker log in as any user on some systems that use one shared company login. SAP strongly recommends applying the fixes as a priority.

Onapsis, the SAP security company whose researchers found three of the four, says it has not seen those three used in attacks. It also says versions of the system's core program that SAP no longer maintains are affected. Those may not get a fix and need an upgrade first, the report says.

The desk's reading: Onapsis found earlier this month that working attack code, or a demonstration of it, now follows an SAP patch within one to three days. Four top-rated fixes in one month leave SAP teams days to act, not weeks.