ZeroHour

CVE-2026-76958

large

XXE Injection in SAP Integration Suite Allows Sensitive File Read via Logs

CVSS 3.1
8.5 high
EPSS
<1%p13
Published
()
Modified
AI analysis

SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components, permitting XML external entity (XXE) injection (CWE-611). An attacker with low-privilege (authenticated) access can submit specially crafted XML payloads containing malicious external entity declarations over the network, with no user interaction required. Successful exploitation lets the attacker read sensitive files from the server, with the contents exposed through monitoring or logging output, and can also cause resource exhaustion; confidentiality impact is high, availability impact is low, and there is no integrity impact (CVSS 3.1 score 8.5, scope changed). Any organization running SAP Integration Suite, a cloud-delivered platform whose tenants consume SAP-managed components, is affected until the September 2026 SAP security updates are applied. No exploitation has been observed so far: there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS assigns only a 0.2% probability of exploitation within the next 30 days.

What to do: Apply the SAP Integration Suite fixes released in the September 2026 SAP Security Patch Day, locating the corresponding SAP security note via CVE-2026-76958 for the exact component and version details (not disclosed in this data). Because file contents may be exposed through monitoring or logging output, review relevant logs for signs of XXE probing or leaked sensitive data and treat affected log stores as potentially containing sensitive information. Additionally, restrict low-privilege access to XML-accepting endpoints and disable or limit external entity resolution where configuration options allow.

Affected
SAP Integration Suite (certain internal components that accept XML documents from untrusted sources)
Estimated exposure
largelikely tens of thousands of cloud tenants/subscriptions (order-of-magnitude estimate; no counts in source data) — No install or tenant counts are provided in the source data, so this is inferred from SAP Integration Suite's role as SAP's primary cloud integration (iPaaS) platform with a broad enterprise tenant base, where the vulnerable components run…

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity declarations. Successful exploitation could allow the attacker to read sensitive file contents from the server and expose them through monitoring or logging output, resulting in a high impact on confidentiality. It could also lead to resource exhaustion, causing a low impact on availability. There is no impact on integrity.

Weakness
CWE-611
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

In the news

SAP September 2026 Security Update Fixes 4 Critical Vulnerabilities and 15 Other Flaws

SAP's September 2026 Patch Tuesday ships 19 security notes, including four criticals led by a CVSS 10.0 memory-corruption flaw in Extended Passport Processing.

SAP released 19 new Security Notes plus one update, fixing four critical vulnerabilities and 15 additional flaws. The most urgent is CVE-2026-44756 (CVSS 10.0), memory corruption in Extended Passport (EPP) Processing affecting many SAP Kernel and Web Dispatcher releases. Other criticals include CVE-2026-58240 (NetWeaver Message Server missing authentication, 9.8), CVE-2026-76969 (credential disclosure in CAP sap/cds-mtxs, 9.4), and CVE-2026-66768 (improper access control in SAP GUI for Java, 9.0). High-severity fixes cover XXE in Integration Suite Trading Partner Management, deserialization in NetWeaver Business Client, and memory corruption in NetWeaver AS for ABAP.

SAP Security Updates September 2026 – Critical Flaws Patched in SAP NetWeaver, Cloud and Extended Passport

SAP's September 2026 Patch Day fixes 19 notes including CVE-2026-44756 (CVSS 10.0), unauthenticated memory corruption in SAP Extended Passport Processing kernels.

SAP shipped 19 new security notes plus one update across NetWeaver, S/4HANA, Integration Suite, Commerce Cloud, and Cloud Application Programming Model. Top issues include CVE-2026-44756 (CVSS 10.0 memory corruption in SAP Extended Passport Processing across many KERNEL and Web Dispatcher versions), CVE-2026-58240 (CVSS 9.8 missing authentication in NetWeaver Message Server), CVE-2026-76969 (CVSS 9.4 credential disclosure in CAP library sap/cds-mtxs), and CVE-2026-66768 (CVSS 9.0 access control flaw in SAP GUI for Java). No exploitation is reported; organizations running affected kernels are urged to patch urgently.