Oracle Ships 12 AI Agents. AI Code Incidents Up 43%. SAP Ships Log4j at CVSS 9.8.

What changed

On the security side, SAP released 15 new security notes on March 10. Two are rated HotNews. The most dangerous is a CVSS 9.8 code injection vulnerability in SAP Quotation Management Insurance (FS-QUO) - caused by an outdated Apache Log4j 1.2 library in the scheduler module. It allows unauthenticated remote code execution - no credentials needed. The second HotNews fix (CVSS 9.1) addresses insecure deserialization in NetWeaver Enterprise Portal. A CVSS 7.7 denial-of-service vulnerability affects SAP Supply Chain Management. Additional fixes cover SSRF, SQL injection, XSS, missing authorization checks, and DLL hijacking across NetWeaver, Business One, S/4HANA, Business Warehouse, and SAP GUI for Windows.

Two days later, S/4HANA Cloud Public Edition 2602.1 went live as a mandatory update. Joule AI-assisted situation handling is GA - Joule evaluates company policies and recommends actions. AI-assisted error explanation for cost accounting walks users through step-by-step fixes. The new Fiori shell bar is now the default interface, with opt-out only until Q3 2026. Joule Agent Builder is GA - customers can build custom AI agents. Beta features include smart helpers that execute repetitive Fiori tasks and AI-assisted Easy Fill for forms. SAP also published an 8-part UX blog series covering Joule Deep Research, Joule Action Bar, Document AI in SAP Mobile Start, a Payroll Agent in SuccessFactors, and an accrual proposal agent that automates period-end close activities.

Why this matters for you

You are handling two fundamentally different testing priorities in the same sprint. The Log4j vulnerability is unauthenticated and remotely exploitable - your Basis team needs a patching window and your QA team needs regression on every landscape running FS-QUO, Enterprise Portal, or Supply Chain Management. Simultaneously, the 2602.1 release expands regression scope across the board: the Fiori shell bar default changes the UI for every user, and Joule is now making financial recommendations in cost accounting that someone needs to validate.

The deeper concern is structural. AI features are no longer optional add-ons. Joule is embedded in financial workflows. Custom agents are being built by customers. An accrual agent automates period-end close. These are non-deterministic systems producing recommendations that affect financial reporting - traditional pass/fail testing doesn't cover this. If your landscape spans cloud and on-premises, the innovation gap widens further: AI features, smart helpers, and Agent Builder are cloud-only, creating a two-speed testing reality.

What you can do

For patches: prioritize the Log4j fix (FS-QUO) this week. Coordinate with Basis on the Enterprise Portal deserialization fix. Add the Supply Chain Management DoS vulnerability to your priority list. For the release: start regression on the Fiori shell bar now - opt-out closes Q3 2026. Build a testing approach for AI-assisted recommendations in cost accounting: define what correct means for Joule's suggestions against your specific company policies, then test against those definitions. If your organization is using Joule Agent Builder, establish governance for custom agent testing before agents proliferate.

Watch out for

The 2602.1 release naming is confusing even among experienced SAP leaders. Confirm which features are GA versus beta before building test plans.

What changed

Release 26A delivers AI agents across every major module. In ERP: improved invoice handling, change order automation, cash basis accounting expansion, and embedded Bank of America banking services. In HCM: a Manager Concierge agent providing team analytics and context-driven deep links, a Plan Fit Agent guiding benefits enrollment, scheduling agents, applicant screening agents, and GenAI for note fields and approval workflows. In SCM: 12+ agents spanning planning, procurement, manufacturing, inventory, and logistics. In CX: audience analysis, quote generation, and advanced bot detection.

The most significant infrastructure change: Oracle AI Agent Studio now supports MCP and A2A protocol. Oracle agents can communicate with and operate across non-Oracle systems - an agent in Fusion can trigger actions in Jira, document management, or testing tools through standardized protocols. Two new EPM agents were also introduced. All mandatory quarterly updates - you cannot skip them.

Why this matters for you

You did not opt into AI agents making decisions in your HCM, supply chain, or financial processes. They arrived with the quarterly update. Your regression scope now includes territory most QA teams have never tested: validating that a Manager Concierge gives accurate team analytics, that a Plan Fit Agent recommends the right benefits plan based on your specific policies, that procurement agents respect your approval hierarchies.

MCP and A2A support adds another layer. Agents operating across system boundaries introduce cascading action scenarios: an agent in Oracle HCM detects a compliance issue, triggers a Jira workflow, which initiates an audit trail in document management. Testing individual agents is hard enough. Testing cross-system agent interactions is a discipline that didn't exist six months ago.

What you can do

Start in your 26A test environment (it gets the update before production). Identify which agents are enabled by default versus opt-in. For financial-process agents, build explicit test cases around your company-specific policies. For HCM agents, verify role-based access controls - an agent shouldn't surface team analytics to someone without appropriate access. Raise MCP/A2A with your Oracle admin: understand which cross-system connections are being enabled and whether agents write data to non-Oracle systems.

What changed

The Home page and Search page UI have been redesigned - global search bar repositioned, pinned categories display differently. These affect every user's daily workflow. A new Payroll Agent retrieves basic payroll information for employees. A Payroll Data Insights agent monitors for missing or outdated data, including minimum wage rate discrepancies. An AI chatbot handles employee self-service queries. Other changes include schedule visibility in the Absence module, improved Change Job corrections at scale via a new EIB, and expanded Job Profile restriction capabilities. Workday delivered 460+ features across its 2025 releases. The 2026 R2 release (expected September) makes these UI changes mandatory with no opt-out.

Why this matters for you

UI changes touch daily workflows for every Workday user. Custom reports, integrations, and training materials referencing the old layout need updating. The Payroll Agent demands careful attention - payroll errors have immediate, personal impact on employees. You need to verify: does the Data Insights agent flag everything it should? Does it generate false positives that waste your payroll team's time? How does it handle edge cases - employees on leave, cross-jurisdiction transfers, retroactive adjustments?

Multiple consultancies warn the biggest risk is not R1 itself but unfinished adoption from 2025 R2. If your organization enabled R2 features but never fully adopted them, you are stacking new functionality on top of an unstable baseline. AI-driven capabilities multiply the cost of poor data quality - if master data is inconsistent, the Payroll Data Insights agent will either miss real problems or flag phantom ones.

What you can do

Before you focus on R1-specific testing, audit your 2025 R2 adoption status. Identify any R2 features enabled but never fully validated. Resolve those first. Then test R1 UI changes against your workflows - especially custom Home page configurations. For the Payroll Agent, create scenarios covering your real edge cases: multi-state employees, union/non-union differences, mid-period transfers, retroactive changes. Mark September now - whatever you don't catch becomes permanent.

Watch out for

The preview window ran February 7 through March 14 - shorter than ideal if you're juggling SAP Patch Day and Oracle 26A in the same period. If Workday testing was compressed by other priorities, allocate post-deployment validation time now.

What changed

Oracle paused EPM Cloud monthly updates after the Essbase 21c upgrade - included in version 25.11 - caused calculation accuracy and performance issues. Affected processes include Planning, Financial Consolidation and Close, Profitability and Cost Management, and Tax Reporting. Five consecutive updates were skipped: versions 25.11, 25.12, 26.01, 26.02, and 26.03. Updates resume with version 26.04. Test environments receive it April 3. Production goes live April 17. Narrative Reporting, Account Reconciliation, and Enterprise Data Management were unaffected.

Why this matters for you

Five months of accumulated changes landing in a single update is the opposite of small, frequent, safe. Your finance team has been stable on a known version - in April they receive every change from five monthly cycles at once. The root cause - Essbase calculation accuracy - is particularly concerning for financial systems. If the vendoru2019s own upgrade caused accuracy problems in calculations used for period-end close and tax reporting, your QA team needs to specifically validate calculation accuracy after 26.04. This is not a standard UI regression pass.

What you can do

Build your 26.04 test plan before April 3. Focus on three areas: calculation accuracy for Planning, Consolidation, and Tax Reporting processes using Essbase cubes; performance benchmarking against current response times; and any customizations or integrations that may have broken during the freeze. If you also run SAP or Workday, coordinate your testing schedule - April will be busy.

What changed

The affected products include Database, Fusion Middleware, E-Business Suite, PeopleSoft, JD Edwards, Java SE, MySQL, and Retail Applications. 27 patches (8%) are rated critical severity. High severity accounts for 45.7% of all patches. Tenable Research discovered a high-severity SSRF vulnerability in Oracle Java (CVE-2026-21945). Oracle Financial Services Applications received 38 patches, 33 of which are remotely exploitable without authentication. The next CPU is scheduled for April 21, 2026.

Why this matters for you

If your organization runs Oracle EBS, PeopleSoft, or Fusion Middleware, the regression testing effort is heavy. The 33 remotely exploitable Financial Services vulnerabilities are especially relevant if you operate in BFSI and face SOX compliance requirements - unpatched vulnerabilities in financial applications create audit findings. Each patch needs impact assessment against your critical business processes before deployment.

What you can do

If you havenu2019t applied the January CPU, prioritize the Financial Services patches that are remotely exploitable without authentication. Coordinate with your security team to map which patches affect your active modules and build a targeted regression plan. Mark April 21 for the next CPU and plan Q2 testing capacity accordingly.

What changed

AI coding assistants accelerated development 5-10x, but production incidents from AI-generated code increased 43% year-over-year. 81% of teams use AI in testing. Security testing startups raised $355M in 12 months. Among practitioners, 65.6% remain concerned about job security - but those who adopted AI tools report lower anxiety.

Why this matters for you

Reframe your value proposition. You are not slowing down delivery. You are preventing the 43% incident increase from reaching your organization. When your CIO asks why QA needs more investment while developers get faster, the answer is: because developers are getting faster. The faster code ships without proportional testing investment, the more incidents accumulate. That 43% is your budget conversation opener.

The 65.6% job security concern is something you will see in your own team. The data shows a clear split: practitioners who engage with AI tools feel much less threatened. Investing in AI literacy training is both a retention strategy and a capability strategy.

What you can do

Use the 43% stat in your next budget conversation. Frame it as risk management. Request your own incident data to see if the trend matches internally. Start an AI literacy program - hands-on experience reduces the 65.6% anxiety.

What changed

Model Context Protocol emerged as the de facto standard for connecting AI agents to enterprise tools in a single quarter. Oracle added MCP and A2A support to AI Agent Studio in Fusion Cloud 26A. Atlassianu2019s Rovo MCP Server went GA, connecting Jira and Confluence to Claude, Cursor, Gemini CLI, and other AI clients. Tricentis published an MCP Server for SAP Enterprise Continuous Testing, enabling AI agents to query test assets, scaffold tests, and analyze runs from development environments. Mablu2019s MCP Server integrates with Jira, X-Ray, and IDEs. Sauce Labs integrated via MCP as well.

In practice: an AI agent in your IDE can now query SAP test results through Tricentis MCP Server, create a Jira issue through Atlassianu2019s Rovo MCP Server, and trigger a Mabl regression test - all through standardized connections. Enterprises account for nearly 50% of all Rovo MCP Server usage, and one-third of all agentic MCP operations are writes - creating and updating content, not just reading.

Why this matters for you

Agents operating across system boundaries create cascading actions that are difficult to trace. Who validates what the agent does? Each cross-system connection is a new test scenario and a governance question.

What you can do

Map which MCP connections exist in your environment today. Establish governance before connections proliferate: who approves new ones, what audit trails exist, who is accountable for cross-system agent errors.

What changed

On the TestGuild Automation Podcast on March 15, Adam Sandman - co-founder of Inflectra - laid out a decomposition strategy for testing AI-enabled applications. The core idea: do not treat your entire application stack as non-deterministic just because it has AI components. Break it apart. Apply traditional deterministic testing to the UI layer, the data layer, and the APIs - these still behave predictably. Apply new statistical or agent-based testing approaches only to the AI components that produce non-deterministic outputs. The key insight: most enterprise applications are still majority deterministic. The AI layer sits on top of a traditional stack.

Why this matters for you

You don't need to reinvent your testing strategy. For SAP: Joule's recommendations are non-deterministic, S/4HANA transactions are deterministic. Test them separately. Same for Oracle's agents and Workday's Payroll Agent.

What you can do

Map your applications into deterministic and non-deterministic layers. Build targeted test approaches for AI components: expected-range validation, consistency testing, boundary cases. Keep existing regression suites for everything else.

Your leadership likely expects AI-driven testing within 18 months, but your team doesn't trust it. Start with your lowest-risk domain, demonstrate measurable improvements, expand only after trust is earned. Report in leadership's language: cost reduction, cycle time, incident prevention.

What changed

Tricentis announced three core platform components. Agentic Test Automation in Tosca generates complete, executable end-to-end tests from natural language input across SAP, web, and enterprise technologies. Agentic Test Creation in qTest transforms natural language inputs into reusable test cases while eliminating duplication and linking requirements, results, and risk signals. Agentic Performance Testing in NeoLoad introduces autonomous performance workflows with AI Chat, claiming up to 95% reduction in analysis time. An AI Workspace orchestrates and governs AI agents across the SDLC. Vision AI provides self-healing, platform-agnostic UI automation.

The Forrester Consulting Total Economic Impact study, published the next day, quantified the business value of Tricentis SAP QA solutions from customer interviews: 403% ROI, 84% reduction in testing scope through LiveCompare change impact analysis, 83% reduction in release cycle times, and significant hypercare cost savings. One customer used LiveCompare to identify exactly which functionality an S/4HANA migration put at risk, eliminating unnecessary testing.

Why this matters for you

Two things are valuable here. First, the platform launch defines the market benchmark for what enterprise agentic testing means in 2026 - other vendors will be measured against these capabilities. If you are evaluating testing tool investments, this is the reference architecture.

Second, the Forrester ROI data is strategic ammunition. Hard ROI data for SAP testing automation is rare, and these are specific, sourced numbers: 403% return, 84% scope reduction, 83% cycle time reduction. If you need to build a business case for testing tool investment - especially for S/4HANA migration programs where the testing budget is first to be squeezed - these are defensible numbers for your CIO.

What you can do

Download the Forrester study. Use the 84% scope reduction and 83% cycle time stats in your next business case. If evaluating testing tools, use this platform as the reference architecture for comparison. But note: the 403% ROI comes from Tricentis SAP QA solutions specifically. Do not extrapolate to non-SAP environments without validation. And remember that vendor-commissioned studies, even from Forrester, present best-case scenarios from selected customers.

Teams can assign tasks to Rovo agents, @mention agents in comments, embed them in workflows. Enterprises account for 50% of usage, one-third of operations are writes. For QA teams, the opportunity is real: automated triage, sprint planning, test case management. The governance question is equally real: who validates agent-created work items? Review your Jira settings to check if Rovo agents are enabled.

Sauce Labs launched AI for Test Authoring - specify what the application should do, and the agent generates framework-agnostic tests. The evaluation question for enterprise QA: how well does intent-driven testing handle SAP Fiori, Oracle ADF, and Workday dynamic UIs compared to web-native applications? Complex ERP workflows make intent specification harder.

ISG surveyed 200+ decision-makers. Fewer than 1 in 5 re-implement processes. 49% do little or no re-engineering. Nearly 60% exceed budget. ISG explicitly identifies integration testing and change management as critical gaps. Use the 60%-over-budget finding in your next migration governance meeting.

75% of testing problems trace to ambiguous requirements - not tools, automation, or test data. 49% of practitioner questions reveal knowledge gaps as the real concern. No AI testing tool fixes unclear specs. Present the 75% stat to engineering leadership and propose QA in requirements review as defect prevention.

SAP launched Foundational (included with cloud), Advanced (proactive guidance, priority SLAs), and Max (dedicated success manager, AI prototype development access). Your support tier now directly determines how quickly you can adopt and test AI capabilities.

Fully enforceable since June 2025. Existing content must comply by June 2030. If your QA team doesn't include WCAG 2.1 AA testing in release cycles for EU-facing applications, add it now.

What this covers

A ground-level look at where AI agents are delivering real results in enterprise ERP testing and where they are still catching up. Written from actual client experience, not vendor demos.

Key takeaways

Requirements are where most escaped defects start. BA agents go straight to the source, reading system configuration and producing structured BRDs with dependencies already mapped. That VAT rounding error that breaks cross-border invoices? A BA agent with system access would have flagged the dependency before anyone started writing tests.

Regression scoping is the biggest waste. 60 to 80% of regression effort covers areas that did not change. Agents analyze actual transports and config changes to cut that waste down to targeted scenarios. One client went from 380 regression scenarios to 90, cut cycle time from 28 days to 11, and found more defects because testers were focused on areas of real risk.

Self-healing scripts cut maintenance by 30 to 40%. Current versions understand what UI elements mean, so they know Purchase and Buy Now are the same button even when the technical attributes are completely different.

Where agents still fall short: Data quality is the single biggest barrier. If your ERP has years of dirty data, clean it before adding agents. Multi-system coordination across SAP, Salesforce, and custom middleware is still catching up. And full autonomy is not the goal: agents handle speed and pattern recognition, people make judgment calls.

What you can do

Start with one change cycle. Pick a module where regression waste is highest. Measure cycle time, defect detection, and maintenance effort before and after. That data becomes your business case for expanding.

What this covers

A practical blueprint for the QA team of 2027: 3 layers, 7 roles, and an 18-month transition roadmap. Most roles are filled by promoting people you already have.

The 3-layer structure

Layer 1 (Strategy and Intelligence): AI Test Strategist who owns the human-AI operating model, and Quality Intelligence Analyst who mines defect data to predict where risk actually lives. In a team of 20-25, both start as part-time responsibilities on existing senior leads.

Layer 2 (Execution and Specialization): Agentic Test Automation Architect who directs AI agents instead of writing scripts, AI Output QA Analyst who validates AI-driven features in SAP/Oracle/Workday, and Continuous Quality Engineer who extends QA into production monitoring.

Layer 3 (Platform and Compliance): Quality Platform Engineer who builds self-service infrastructure so QA stops being a bottleneck, and Compliance Automation Lead who embeds regulatory requirements directly into the pipeline.

Where to start

Match your first role to your biggest pain point. If releases are slow despite AI tools, start with the AI Test Strategist. If script maintenance is eating your automation team, start with the Agentic Automation Architect. If audits delay every release, the Compliance Automation Lead unblocks you fastest. Pick one, build it over a quarter, prove the value, then expand.

When your CIO asks why QA needs more investment while developers ship faster, here are the three sentences: AI coding tools accelerated our development 5-10x. Industry data shows production incidents from AI-generated code are up 43% year over year. We are not slowing delivery down. We are preventing that 43% from reaching our production systems.

Then ask for your own incident data. If the trend matches, you have the strongest budget case in a decade. If it does not, you have a competitive advantage worth documenting.

Before enabling MCP connections in your environment, sit down with your IT team and ask: (1) Which agents currently have cross-system write access? (2) What happens when an agent in Oracle HCM triggers a Jira workflow that creates an audit trail in document management? Who owns the testing for that cascade? (3) Can agents be scoped to read-only for specific systems? (4) What logging exists for cross-system agent actions? (5) Who approves new MCP connections, and is there a review process before they go live?

If your IT team cannot answer these today, that is the problem to solve before agents proliferate.

Assign one SDET to test one agentic testing tool on a single module for 30 days. Have them measure: (1) how many regression scenarios the tool correctly identified as unnecessary, (2) how much maintenance time was saved on script healing, and (3) whether the tool found defects the existing suite missed.

Document the findings in a one-page report with before and after numbers. That report becomes your business case. Real data from your own environment beats any vendor demo.