SAP September 2026 Security Update Fixes 4 Critical Vulnerabilities and 15 Other Flaws

In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html * https://w4ke.info/2025/10/29/funky-chunks-2.html Jetty terminates chunk extension parsing at \r\n inside quoted strings instead of treating this as an error. POST / HTTP/1.1 Host: localhost Transfer-Encoding: chunked 1;ext="val X 0 GET /smuggled HTTP/1.1 ... Note how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.

CVE-2026-44756 is a critical (CVSS 10.0) memory-safety flaw — a classic buffer overflow (CWE-120) — in the Extended Passport Protocol (EPP) processing library of SAP Kernel, the core runtime underlying SAP NetWeaver components (SAP's advisories tie the issue to SAP Kernel and the NetWeaver Message Server). An unauthenticated remote attacker can trigger it by sending a crafted network request containing a malformed EPP header to a system that processes EPP traffic. The malformed header causes undefined behavior and abnormal program termination, and SAP's maximum-severity rating plus vendor coverage of the flaw indicate it can enable unauthenticated remote code execution with high impact on confidentiality, integrity, and availability. Any organization running the affected SAP Kernel/NetWeaver components — essentially typical ABAP-stack SAP deployments — is exposed until patched. No public proof-of-concept is known, the flaw is not in CISA KEV, EPSS estimates only a 0.3% chance of exploitation within 30 days (25th percentile), and fixes shipped in SAP's September 2026 Security Patch Day.

Do: Apply the SAP Kernel and NetWeaver Message Server fixes released in SAP's September 2026 Security Patch Day (per the 2026-011 advisory covering this flaw), since specific fixed version numbers are not listed in the available data. As interim mitigation, restrict network access to SAP kernel and message-server services to trusted internal networks and identify any SAP instances exposed to the internet. Check SAP's advisory for the exact patch levels applicable to your kernel releases and prioritize externally reachable systems.

CVE-2026-44766 is a SQL injection flaw (CWE-89) in the Intercompany Matching and Reconciliation (IMR) component of SAP S/4HANA. A low-privileged authenticated user can submit crafted input to certain IMR functions, which is passed to the underlying database without proper validation, allowing malicious queries to execute. An attacker gains unauthorized read access to sensitive information in the database — a high confidentiality impact — with no effect on integrity or availability, and no user interaction is required beyond the attacker's own valid low-privilege session. Only organizations running SAP S/4HANA with the IMR component in use are affected; exposure is internal-facing, since exploitation requires an authenticated account rather than anonymous internet access. There is no public proof of concept, the flaw is not in CISA's KEV catalog, and EPSS of 0.2% (13th percentile) indicates no known exploitation; fixes were shipped as part of SAP's September 2026 Security Patch Day.

Do: Apply the SAP September 2026 Security Patch Day corrections for S/4HANA IMR, checking the SAP Security Note for this CVE to match the correct patch level to your installed release. Until patched, restrict low-privileged access to the affected IMR functions and review database logs for unexpected or anomalous queries issued by IMR service users.

SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components when they register with the service (CWE-308). An unauthenticated attacker with network access to the affected service can send a crafted registration request to add or impersonate an application server component. Once registered, the attacker can potentially perform unauthorized actions within the SAP application environment, resulting in a high impact on confidentiality, integrity, and availability — reflected in the critical CVSS 9.8 score. Any organization running SAP NetWeaver deployments that rely on the Message Server is affected; the source data does not specify exact affected version ranges. There is no evidence of active exploitation, no public proof-of-concept, and the issue is not in CISA KEV, with EPSS assigning only a ~0.3% 30-day exploitation probability; a fix shipped in SAP's September 2026 Security Patch Day (a release that also patched other critical flaws, including the separately reported 'OVERPASS' SAP Kernel issue).

Do: Apply the SAP NetWeaver Message Server fix from the September 2026 SAP Security Patch Day (referenced as advisory 2026-011) as a priority, since the flaw is unauthenticated and network-triggerable; check SAP's portal for the corrected builds applicable to your release, as no specific version numbers were provided in the source data. Until patching, restrict network access to the Message Server (typically TCP 36xx, e.g., 3600) to trusted application server hosts and internal networks, and verify no message server listener is reachable from the internet. Monitor SAP security notes for updates, as no public exploit exists today.

SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database operations against SAP NetWeaver AS ABAP. Successful exploitation could allow the attacker to read sensitive data, modify application data, and disrupt access for legitimate users, resulting in high impact on confidentiality, integrity, and availability.

SAP NetWeaver Application Server for ABAP and ABAP Platform contains an unauthenticated session-hijacking flaw (CWE-191, incorrect type validation) in which a specially crafted network packet causes the server to reprocess a previously buffered user request. Because the flaw can only be triggered under narrow timing conditions, an unauthenticated remote attacker may be able to replay another user's buffered request and take over that user's session, gaining high-impact access to the victim's confidentiality and integrity with only low impact on availability. Any organization running SAP NetWeaver AS for ABAP or ABAP Platform is potentially affected, though the attack surface depends on whether the affected service is reachable from untrusted networks. No public proof-of-concept, CISA KEV listing, or confirmed exploitation is known; EPSS currently estimates only a 0.3% probability of exploitation within 30 days.

Do: Apply the SAP September 2026 Security Patch Day corrections for NetWeaver AS for ABAP and ABAP Platform, using SAP's advisory to identify the note and patch level matching your installed releases. Until patched, restrict network access to the affected SAP application server services from untrusted networks, and monitor for anomalous session reuse or unexpected session takeover. Given the high attack complexity and lack of known exploitation, prioritize patching within normal monthly maintenance windows unless the service is internet-exposed.

SAP GUI for Java (CWE-807) fails to correctly enforce its trust level policy when certain functions are invoked from a connected backend system, meaning the client relies on untrusted backend input when making security decisions. To exploit it, an attacker needs low-privileged access to a connected backend (for example, a compromised or malicious SAP backend) and must manipulate that backend to trigger the affected functionality, which also requires interaction from the logged-in user (CVSS UI:R). Successful exploitation yields arbitrary command execution on the victim's workstation, with the changed-scope vector (S:C) allowing a backend-level foothold to break out onto the end-user machine and seriously impacting its confidentiality, integrity, and availability. Anyone running SAP GUI for Java to connect to SAP backends is exposed, particularly in scenarios where less-trusted or low-privileged users can influence the backend their colleagues connect to. There is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.3% chance of exploitation in the next 30 days, so no in-the-wild exploitation is currently known; a fix shipped as part of SAP's September 2026 security patch day.

Do: Deploy the SAP GUI for Java patch released with SAP's September 2026 security updates, checking the SAP advisory for the exact affected and fixed versions for your release line. Inventory endpoints running SAP GUI for Java (especially macOS/Linux desktops) and the backends they connect to, prioritizing users who connect to backends accessible to low-privileged or external users. As an interim mitigation, restrict low-privileged accounts' ability to invoke the affected backend functions and treat backend compromise as a path to client workstation takeover when assessing risk.

SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components, permitting XML external entity (XXE) injection (CWE-611). An attacker with low-privilege (authenticated) access can submit specially crafted XML payloads containing malicious external entity declarations over the network, with no user interaction required. Successful exploitation lets the attacker read sensitive files from the server, with the contents exposed through monitoring or logging output, and can also cause resource exhaustion; confidentiality impact is high, availability impact is low, and there is no integrity impact (CVSS 3.1 score 8.5, scope changed). Any organization running SAP Integration Suite, a cloud-delivered platform whose tenants consume SAP-managed components, is affected until the September 2026 SAP security updates are applied. No exploitation has been observed so far: there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS assigns only a 0.2% probability of exploitation within the next 30 days.

Do: Apply the SAP Integration Suite fixes released in the September 2026 SAP Security Patch Day, locating the corresponding SAP security note via CVE-2026-76958 for the exact component and version details (not disclosed in this data). Because file contents may be exposed through monitoring or logging output, review relevant logs for signs of XXE probing or leaked sensitive data and treat affected log stores as potentially containing sensitive information. Additionally, restrict low-privilege access to XML-accepting endpoints and disable or limit external entity resolution where configuration options allow.

SAP NetWeaver Business Client does not sufficiently validate certain locally stored data that it processes at application startup, a flaw classified as CWE-502 (deserialization of untrusted data). An attacker with low privileges on the local system can replace this data with specially crafted content, and when the application is next launched the crafted content is processed with no further user interaction required. Successful exploitation results in arbitrary code execution in the context of the logged-on user, with high impact on the confidentiality, integrity, and availability of the application. Any organization running the SAP NetWeaver Business Client desktop application is affected, and fixes were delivered as part of SAP's September 2026 Security Patch Day. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS currently estimates only a 0.2% probability of exploitation within 30 days.

Do: Apply the SAP security patch released with the September 2026 Patch Day to all systems running SAP NetWeaver Business Client, checking SAP's advisory for the specific affected and corrected releases. Because exploitation requires low-privileged local access, limit write access to the application's locally stored data/configuration locations and maintain endpoint hardening on workstations running the client. No workarounds are described in the available data, so prompt patching is the primary remediation.

CVE-2026-76968 is an information disclosure flaw (CWE-497) in SAP Web Dispatcher, SAP Internet Communication Manager (ICM), and SAP Content Server in which an authenticated user with only low privileges can reach administrative functionality or interfaces that should be off-limits to them. The attacker triggers the flaw by sending requests over the network to these administrative endpoints using valid low-privileged credentials, requiring no user interaction. By reading the exposed administrative interface, the attacker obtains sensitive information about the system state, which could be used to facilitate further attacks, although integrity and availability are not affected. Any organization running the affected SAP components is exposed, and because ICM is embedded in SAP's application server stack, this potentially touches a very broad base of SAP on-premise and cloud deployments. As of now there is no evidence of exploitation, no public proof-of-concept, and the issue is not in CISA's KEV catalog; fixes were shipped with the SAP September 2026 Security Patch Day updates.

Do: Apply the SAP security fixes released with the September 2026 Security Patch Day (check SAP Note/CVE-2026-76968 for the exact patch levels for Web Dispatcher, ICM and Content Server, as version details are not in this data). Until patching, restrict access to the administrative interfaces of these components using network controls and review which low-privileged users can reach them. Since exploitation requires valid credentials, prioritize review of recently created or over-privileged service and end-user accounts.

CVE-2026-76969 is a critical flaw (CVSS 9.4) in SAP's @sap/cds-mtxs npm package, the multitenancy component of the SAP Cloud Application Programming Model (CAP), which performs insufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker who can reach the affected endpoints can send specially crafted requests that cause the service to disclose sensitive credentials. With those credentials, the attacker can replace or delete tenant data, resulting in high impact to integrity and availability and partial impact to the confidentiality of business data. Only deployments running multitenant CAP applications on @sap/cds-mtxs with extensibility enabled are affected. Exploitation has not been observed: there is no known public proof of concept, the issue is not in CISA KEV, and EPSS estimates only a ~0.3% probability of exploitation within 30 days.

Do: Update the @sap/cds-mtxs dependency in all multitenant CAP applications to the fixed version given in SAP's security advisory for CVE-2026-76969 (part of SAP's September 2026 patch batch) and redeploy the affected applications. Audit whether your CAP applications use multitenancy with extensibility enabled and whether the mtxs endpoints are reachable without authentication, and rotate any tenant-scoped credentials that could have been exposed. As an interim mitigation, restrict network access to the mtxs/sidecar endpoints to trusted callers.