SAP Cloud Application Programming Model

Mentions · 7d0
Mentions · 30d0
All mentions4
First seenSep 8, 2026
Last mentionedSep 9, 2026

Timeline

4 articles · newest first

SAP Patches Maximum Severity “Overpass” Flaw

Onapsis warns over 10,000 internet-facing SAP systems may be exposed to maximum-severity unauthenticated RCE flaw CVE-2026-44756 in SAP Extended Passport.

Infosecurity MagazineSep 9, 08:15 UTC · Sep 9, 2026VulnerabilityCVE-2026-44756 CVE-2026-58240 CVE-2026-76969+11 · 1 read

SAP Patches CVSS 10.0 Kernel Flaw Enabling Unauthenticated Remote Code Execution

SAP patched CVE-2026-44756 (CVSS 10.0), an unauthenticated kernel memory corruption allowing OS command execution, plus three other critical flaws.

The Hacker NewsSep 9, 06:25 UTC · Sep 9, 2026VulnerabilityCVE-2026-44756 CVE-2026-58240 CVE-2026-76969+12

SAP security advisory – September 2026 monthly rollup (AV26-894)

Canada's Cyber Centre relayed SAP's September 2026 Patch Day rollup covering vulnerabilities across NetWeaver, kernel components, CAP, and Integration Suite.

Canadian Centre for Cyber SecuritySep 8, 18:03 UTC · Sep 8, 2026Advisory2 · 1 read

SAP September 2026 Security Update Fixes 4 Critical Vulnerabilities and 15 Other Flaws

SAP's September 2026 Patch Tuesday ships 19 security notes, including four criticals led by a CVSS 10.0 memory-corruption flaw in Extended Passport Processing.

GBHackersSep 8, 10:24 UTC · Sep 8, 2026VulnerabilityCVE-2026-44756 CVE-2026-58240 CVE-2026-76969+84 · 2 reads

Related CVEs

by mentions

CVE-2026-44756<1%10.0
Unauthenticated buffer overflow in SAP Kernel Extended Passport (EPP) processing
published Sep 8, 2026SAP Kernel (Extended Passport Protocol (EPP) processing library)
CVE-2026-58240<1%9.8
Unauthenticated Component Registration Flaw in SAP NetWeaver Message Server
published Sep 8, 2026SAP NetWeaver Message Server
CVE-2026-76969<1%9.4
Unauthenticated Credential Theft and Tenant Data Tampering in SAP @sap/cds-mtxs
published Sep 8, 2026SAP @sap/cds-mtxs npm library (CAP multitenancy service; exploitable when used in multitenant CAP applications with extensib
CVE-2026-66768<1%9.0
Trust Level Policy Bypass Enables RCE in SAP GUI for Java
published Sep 8, 2026SAP GUI for Java
CVE-2026-23321%9.1
In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here
published Apr 14, 2026eclipse jettyPoC
CVE-2026-58243<1%8.8
SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute…
published Aug 11, 2026
CVE-2026-76958<1%8.5
XXE Injection in SAP Integration Suite Allows Sensitive File Read via Logs
published Sep 8, 2026SAP Integration Suite (certain internal components that accept XML documents from untrusted sources)
CVE-2026-76967<1%7.8
Deserialization flaw allows local code execution in SAP NetWeaver Business Client
published Sep 8, 2026SAP NetWeaver Business Client
CVE-2026-66767<1%7.7
Unauthenticated Session Hijack via Buffered Request Replay in SAP NetWeaver AS for ABAP
published Sep 8, 2026SAP NetWeaver Application Server for ABAP
CVE-2026-76968<1%6.5
Authenticated Information Disclosure in SAP Web Dispatcher, ICM and Content Server
published Sep 8, 2026SAP Web Dispatcher

Appears with

SAPvendor · 4
SAP NetWeaverproduct · 3
SAP Integration Suiteproduct · 2
SAP S/4HANAproduct · 2
Onapsisvendor · 2
SAP GUI for Javaproduct · 2
SAP Extended Passportproduct · 1
SAP Kernelproduct · 1
S/4HANAproduct · 1
SAP Web Dispatcherproduct · 1
NetWeaver Message Serverproduct · 1
SAPorganization · 1
Onapsisorganization · 1
NetWeaver Business Clientproduct · 1
Canadian Centre for Cyber Securityvendor · 1
NetWeaver AS for ABAPproduct · 1

Entities are extracted by the model from each article. First seen Sep 8, 2026, last mentioned Sep 9, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.