SAP September 2026 Security Update Fixes 4 Critical Vulnerabilities and 15 Other Flaws
SAP's September 2026 Patch Tuesday ships 19 security notes, including four criticals led by a CVSS 10.0 memory-corruption flaw in Extended Passport Processing.
SAP released 19 new Security Notes plus one update, fixing four critical vulnerabilities and 15 additional flaws. The most urgent is CVE-2026-44756 (CVSS 10.0), memory corruption in Extended Passport (EPP) Processing affecting many SAP Kernel and Web Dispatcher releases. Other criticals include CVE-2026-58240 (NetWeaver Message Server missing authentication, 9.8), CVE-2026-76969 (credential disclosure in CAP sap/cds-mtxs, 9.4), and CVE-2026-66768 (improper access control in SAP GUI for Java, 9.0). High-severity fixes cover XXE in Integration Suite Trading Partner Management, deserialization in NetWeaver Business Client, and memory corruption in NetWeaver AS for ABAP.
- CVE-2026-44756 (10.0) memory corruption affects SAP Kernel and Web Dispatcher releases.
- CVE-2026-58240 (9.8) is missing authentication in NetWeaver Message Server.
- CVE-2026-76969 (9.4) leaks credentials in multitenant CAP sap/cds-mtxs apps.
- High-severity XXE in Integration Suite TPM and deserialization in NetWeaver Business Client.
- August note CVE-2026-58243 (ABAP Developer Tools privilege escalation, 8.8) updated.
- CVEs
- CVE-2026-44756CVE-2026-58240CVE-2026-76969CVE-2026-66768CVE-2026-58243CVE-2026-76958CVE-2026-76967CVE-2026-66767CVE-2026-2332CVE-2026-76968CVE-2026-44766
- Vendors
- SAP
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-2332 | In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here | 9.1 | 1% | PoC | |
| CVE-2026-44756 | Unauthenticated buffer overflow in SAP Kernel Extended Passport (EPP) processing | 10.0 | <1% | ||
| CVE-2026-44766 | Authenticated SQL Injection in SAP S/4HANA Intercompany Matching and Reconciliation | 6.5 | <1% | ||
| CVE-2026-58240 | Unauthenticated Component Registration Flaw in SAP NetWeaver Message Server | 9.8 | <1% | ||
| CVE-2026-58243 | SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute… | 8.8 | <1% | ||
| CVE-2026-66767 | Unauthenticated Session Hijack via Buffered Request Replay in SAP NetWeaver AS for ABAP | 7.7 | <1% | ||
| CVE-2026-66768 | Trust Level Policy Bypass Enables RCE in SAP GUI for Java | 9.0 | <1% | ||
| CVE-2026-76958 | XXE Injection in SAP Integration Suite Allows Sensitive File Read via Logs | 8.5 | <1% | ||
| CVE-2026-76967 | Deserialization flaw allows local code execution in SAP NetWeaver Business Client | 7.8 | <1% | ||
| CVE-2026-76968 | Authenticated Information Disclosure in SAP Web Dispatcher, ICM and Content Server | 6.5 | <1% | ||
| CVE-2026-76969 | Unauthenticated Credential Theft and Tenant Data Tampering in SAP @sap/cds-mtxs | 9.4 | <1% |
From the original article
4 min read at gbhackers.com
SAP released 19 new Security Notes addressing four critical vulnerabilities and 15 additional flaws throughout its enterprise portfolio. The vendor also updated one note from August. The most urgent issue is CVE-2026-44756, a memory-corruption vulnerability in Extended Passport (EPP) Processing with a CVSS score of 10.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.