SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking s
SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise internal components, resulting in high impact on confidentiality, integrity, and availability of the application.
—
Unauthenticated buffer overflow in SAP Kernel Extended Passport (EPP) processing
CVE-2026-44756 is a critical (CVSS 10.0) memory-safety flaw — a classic buffer overflow (CWE-120) — in the Extended Passport Protocol (EPP) processing library of SAP Kernel, the core runtime underlying SAP NetWeaver components (SAP's advisories tie the issue to SAP Kernel and the NetWeaver Message Server). An unauthenticated remote attacker can trigger it by sending a crafted network request containing a malformed EPP header to a system that processes EPP traffic. The malformed header causes undefined behavior and abnormal program termination, and SAP's maximum-severity rating plus vendor coverage of the flaw indicate it can enable unauthenticated remote code execution with high impact on confidentiality, integrity, and availability. Any organization running the affected SAP Kernel/NetWeaver components — essentially typical ABAP-stack SAP deployments — is exposed until patched. No public proof-of-concept is known, the flaw is not in CISA KEV, EPSS estimates only a 0.3% chance of exploitation within 30 days (25th percentile), and fixes shipped in SAP's September 2026 Security Patch Day.
· SAP Kernel (Extended Passport Protocol (EPP) processing library) · SAP NetWeaver (kernel components, including Message Server, per SAP's 2026-011 advisory)mass
Unauthenticated Component Registration Flaw in SAP NetWeaver Message Server
SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components when they register with the service (CWE-308). An unauthenticated attacker with network access to the affected service can send a crafted registration request to add or impersonate an application server component. Once registered, the attacker can potentially perform unauthorized actions within the SAP application environment, resulting in a high impact on confidentiality, integrity, and availability — reflected in the critical CVSS 9.8 score. Any organization running SAP NetWeaver deployments that rely on the Message Server is affected; the source data does not specify exact affected version ranges. There is no evidence of active exploitation, no public proof-of-concept, and the issue is not in CISA KEV, with EPSS assigning only a ~0.3% 30-day exploitation probability; a fix shipped in SAP's September 2026 Security Patch Day (a release that also patched other critical flaws, including the separately reported 'OVERPASS' SAP Kernel issue).
· SAP NetWeaver Message Serverlarge
In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here:
In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html * https://w4ke.info/2025/10/29/funky-chunks-2.html Jetty terminates chunk extension parsing at \r\n inside quoted strings instead of treating this as an error. POST / HTTP/1.1 Host: localhost Transfer-Encoding: chunked 1;ext="val X 0 GET /smuggled HTTP/1.1 ... Note how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.
Trust Level Policy Bypass Enables RCE in SAP GUI for Java
SAP GUI for Java (CWE-807) fails to correctly enforce its trust level policy when certain functions are invoked from a connected backend system, meaning the client relies on untrusted backend input when making security decisions. To exploit it, an attacker needs low-privileged access to a connected backend (for example, a compromised or malicious SAP backend) and must manipulate that backend to trigger the affected functionality, which also requires interaction from the logged-in user (CVSS UI:R). Successful exploitation yields arbitrary command execution on the victim's workstation, with the changed-scope vector (S:C) allowing a backend-level foothold to break out onto the end-user machine and seriously impacting its confidentiality, integrity, and availability. Anyone running SAP GUI for Java to connect to SAP backends is exposed, particularly in scenarios where less-trusted or low-privileged users can influence the backend their colleagues connect to. There is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.3% chance of exploitation in the next 30 days, so no in-the-wild exploitation is currently known; a fix shipped as part of SAP's September 2026 security patch day.
· SAP GUI for Javalarge
SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauth
SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database operations against SAP NetWeaver AS ABAP. Successful exploitation could allow the attacker to read sensitive data, modify application data, and disrupt access for legitimate users, resulting in high impact on confidentiality, integrity, and availability.
—
XXE Injection in SAP Integration Suite Allows Sensitive File Read via Logs
SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components, permitting XML external entity (XXE) injection (CWE-611). An attacker with low-privilege (authenticated) access can submit specially crafted XML payloads containing malicious external entity declarations over the network, with no user interaction required. Successful exploitation lets the attacker read sensitive files from the server, with the contents exposed through monitoring or logging output, and can also cause resource exhaustion; confidentiality impact is high, availability impact is low, and there is no integrity impact (CVSS 3.1 score 8.5, scope changed). Any organization running SAP Integration Suite, a cloud-delivered platform whose tenants consume SAP-managed components, is affected until the September 2026 SAP security updates are applied. No exploitation has been observed so far: there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS assigns only a 0.2% probability of exploitation within the next 30 days.
· SAP Integration Suite (certain internal components that accept XML documents from untrusted sources)large
Unauthenticated Session Hijack via Buffered Request Replay in SAP NetWeaver AS for ABAP
SAP NetWeaver Application Server for ABAP and ABAP Platform contains an unauthenticated session-hijacking flaw (CWE-191, incorrect type validation) in which a specially crafted network packet causes the server to reprocess a previously buffered user request. Because the flaw can only be triggered under narrow timing conditions, an unauthenticated remote attacker may be able to replay another user's buffered request and take over that user's session, gaining high-impact access to the victim's confidentiality and integrity with only low impact on availability. Any organization running SAP NetWeaver AS for ABAP or ABAP Platform is potentially affected, though the attack surface depends on whether the affected service is reachable from untrusted networks. No public proof-of-concept, CISA KEV listing, or confirmed exploitation is known; EPSS currently estimates only a 0.3% probability of exploitation within 30 days.
· SAP NetWeaver Application Server for ABAP · SAP NetWeaver Application Server for ABAP Platformlarge
Authenticated SQL Injection in SAP S/4HANA Intercompany Matching and Reconciliation
CVE-2026-44766 is a SQL injection flaw (CWE-89) in the Intercompany Matching and Reconciliation (IMR) component of SAP S/4HANA. A low-privileged authenticated user can submit crafted input to certain IMR functions, which is passed to the underlying database without proper validation, allowing malicious queries to execute. An attacker gains unauthorized read access to sensitive information in the database — a high confidentiality impact — with no effect on integrity or availability, and no user interaction is required beyond the attacker's own valid low-privilege session. Only organizations running SAP S/4HANA with the IMR component in use are affected; exposure is internal-facing, since exploitation requires an authenticated account rather than anonymous internet access. There is no public proof of concept, the flaw is not in CISA's KEV catalog, and EPSS of 0.2% (13th percentile) indicates no known exploitation; fixes were shipped as part of SAP's September 2026 Security Patch Day.
· SAP S/4HANA — Intercompany Matching and Reconciliation (IMR) componentmoderate
Authenticated Information Disclosure in SAP Web Dispatcher, ICM and Content Server
CVE-2026-76968 is an information disclosure flaw (CWE-497) in SAP Web Dispatcher, SAP Internet Communication Manager (ICM), and SAP Content Server in which an authenticated user with only low privileges can reach administrative functionality or interfaces that should be off-limits to them. The attacker triggers the flaw by sending requests over the network to these administrative endpoints using valid low-privileged credentials, requiring no user interaction. By reading the exposed administrative interface, the attacker obtains sensitive information about the system state, which could be used to facilitate further attacks, although integrity and availability are not affected. Any organization running the affected SAP components is exposed, and because ICM is embedded in SAP's application server stack, this potentially touches a very broad base of SAP on-premise and cloud deployments. As of now there is no evidence of exploitation, no public proof-of-concept, and the issue is not in CISA's KEV catalog; fixes were shipped with the SAP September 2026 Security Patch Day updates.
· SAP Web Dispatcher · SAP Internet Communication Manager (ICM)large