CVE-2026-76958

SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components, permitting XML external entity (XXE) injection (CWE-611). An attacker with low-privilege (authenticated) access can submit specially crafted XML payloads containing malicious external entity declarations over the network, with no user interaction required. Successful exploitation lets the attacker read sensitive files from the server, with the contents exposed through monitoring or logging output, and can also cause resource exhaustion; confidentiality impact is high, availability impact is low, and there is no integrity impact (CVSS 3.1 score 8.5, scope changed). Any organization running SAP Integration Suite, a cloud-delivered platform whose tenants consume SAP-managed components, is affected until the September 2026 SAP security updates are applied. No exploitation has been observed so far: there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS assigns only a 0.2% probability of exploitation within the next 30 days.

What to do: Apply the SAP Integration Suite fixes released in the September 2026 SAP Security Patch Day, locating the corresponding SAP security note via CVE-2026-76958 for the exact component and version details (not disclosed in this data). Because file contents may be exposed through monitoring or logging output, review relevant logs for signs of XXE probing or leaked sensitive data and treat affected log stores as potentially containing sensitive information. Additionally, restrict low-privilege access to XML-accepting endpoints and disable or limit external entity resolution where configuration options allow.