SAP security advisory – September 2026 monthly rollup (AV26-894)
Canada's Cyber Centre relayed SAP's September 2026 Patch Day rollup covering vulnerabilities across NetWeaver, kernel components, CAP, and Integration Suite.
The Canadian Centre for Cyber Security published advisory AV26-894 noting that as of September 8, 2026, SAP is affected by vulnerabilities in multiple products, including SAP Extended Passport, NetWeaver Message Server, SAP Cloud Application Programming Model, SAP GUI for Java, Integration Suite Cloud Integration, NetWeaver Business Client, and NetWeaver AS for ABAP. The advisory corresponds to SAP Security Patch Day September 2026 and lists many affected kernel and web dispatcher versions. Administrators are urged to review the SAP advisory and apply updates as available.
- Canadian advisory AV26-894 tracks SAP September 2026 Patch Day
- Affects NetWeaver (Message Server, GUI for Java, Business Client, AS ABAP), kernel 7.22-9.20
- Also covers CAP (<=1.183/2.7.6/3.9.6/4.0.2) and Integration Suite TPM versions
- Users and administrators encouraged to apply available updates
Full article195 words · extracted from cyber.gc.ca · click to collapse
Serial Number: AV26-894
Date: September 8, 2026
As of September 8, 2026, SAP_SE is affected by vulnerabilities in the following products:
- SAP Extended Passport (EPP) Processing – KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, WEBDISP 9.16, 9.18, 9.19, 9.20, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.16, 9.18, 9.19 and 9.20
- SAP NetWeaver (Message Server) - versions KERNEL 9.16, 9.18, 9.19, and 9.20
- SAP Cloud Application Programming Model (CAP)
- prior or equal to 1.183
- prior or equal to 2.7.6
- prior or equal to 3.9.6
- prior or equal to 4.0.2
- SAP NetWeaver (SAP GUI for Java) - version BC-FES-JAV 8.10
- SAP Integration Suite
- Version Cloud Integration - Trading Partner Management V2 2.9.2,
- Version B2B Integration Factory - Cloud Integration - Trading Partner Management 1.10.0
- SAP NetWeaver Business Client – versions BC-WD-CLT-BUS 8.00 and 8.10
- SAP NetWeaver Application Server for ABAP and ABAP Platform – versions KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, KERNEL 7.22, 7.53, 7.54, 7.77, 7.93, 8.04, 9.16, 9.18, 9.19 and 9.20
The Cyber Centre encourages users and administrators to review the provided web link and apply any necessary updates as they become available.
Text extracted automatically; images, tables and formatting may be missing. Original: https://cyber.gc.ca/en/alerts-advisories/sap-security-advisory-september-2026-monthly-rollup-av26-894