SAP security advisory – October 2026 monthly rollup (AV26-1030)
Canadian Cyber Centre urges patching after SAP's October 2026 rollup affects multiple products.
36
Product
SAP NetWeaver
- Mentions · 7d0
- Mentions · 30d1
- All mentions9
- First seenAug 12, 2026
- Last mentioned17d ago
Timeline
9 articles · newest firstSAP Patches Maximum Severity “Overpass” Flaw
Onapsis warns over 10,000 internet-facing SAP systems may be exposed to maximum-severity unauthenticated RCE flaw CVE-2026-44756 in SAP Extended Passport.
82
SAP Patches CVSS 10.0 Kernel Flaw Enabling Unauthenticated Remote Code Execution
SAP patched CVE-2026-44756 (CVSS 10.0), an unauthenticated kernel memory corruption allowing OS command execution, plus three other critical flaws.
68
September 2026 Patch Tuesday roundup: Plugs for two zero day holes among almost 1,000 fixes in Windows
Microsoft's September 2026 Patch Tuesday ships 964 fixes including two exploited Windows zero-days (CVE-2026-85880, CVE-2026-81963) and a wormable DNS RCE.
84
SAP security advisory – September 2026 monthly rollup (AV26-894)
Canada's Cyber Centre relayed SAP's September 2026 Patch Day rollup covering vulnerabilities across NetWeaver, kernel components, CAP, and Integration Suite.
30
SAP warns of maximum severity 'OVERPASS' kernel vulnerability
SAP's September 2026 patches fix maximum-severity kernel flaw CVE-2026-44756 (OVERPASS), letting unauthenticated attackers execute commands on 10,000+ internet-facing SAP systems.
80
SAP Patches Critical Extended Passport Processing Vulnerability
SAP patches CVSS 10.0 flaw CVE-2026-44756 (OVERPASS) enabling unauthenticated RCE in S/4HANA and NetWeaver, plus three other criticals; no in-the-wild exploitation reported.
80
SAP Security Updates September 2026 – Critical Flaws Patched in SAP NetWeaver, Cloud and Extended Passport
SAP's September 2026 Patch Day fixes 19 notes including CVE-2026-44756 (CVSS 10.0), unauthenticated memory corruption in SAP Extended Passport Processing kernels.
60
SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code
SAP patched a CVSS 10.0 unauthenticated RCE flaw (CVE-2026-58231) in Commerce Cloud's Data Hub Adapter, plus three critical flaws in NetWeaver and Manufacturing.
60
Related CVEs
by mentions- CVE-2026-44756<1%10.0Unauthenticated buffer overflow in SAP Kernel Extended Passport (EPP) processing
- CVE-2026-58240<1%9.8Unauthenticated Component Registration Flaw in SAP NetWeaver Message Server
- CVE-2026-76969<1%9.4Unauthenticated Credential Theft and Tenant Data Tampering in SAP @sap/cds-mtxs
- CVE-2026-66768<1%9.0Trust Level Policy Bypass Enables RCE in SAP GUI for Java
- CVE-2026-58231<1%10.0Unauthenticated Code Injection RCE in SAP Commerce Cloud
- CVE-2026-44758<1%9.1SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to submit specially crafted input to certain affected…
- CVE-2026-76958<1%8.5XXE Injection in SAP Integration Suite Allows Sensitive File Read via Logs
- CVE-2026-76968<1%6.5Authenticated Information Disclosure in SAP Web Dispatcher, ICM and Content Server
- CVE-2026-76963<1%4.3Missing authorization check in SAP NetWeaver AS ABAP exposes system configuration data
Appears with
- SAPvendor · 9
- SAP S/4HANAproduct · 7
- Onapsisorganization · 4
- Onapsisvendor · 4
- SAP Web Dispatcherproduct · 3
- SAP Cloud Application Programming Modelproduct · 3
- SAP Commerce Cloudproduct · 3
- SAP GUI for Javaproduct · 2
- SAPorganization · 2
- SAP Integration Suiteproduct · 2
- Action1vendor · 1
- Fortravendor · 1
- Zero Day Initiativevendor · 1
- Windows 11product · 1
- Canadian Centre for Cyber Securityvendor · 1
- Copilot Studioproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.