SAP Security Updates September 2026 – Critical Flaws Patched in SAP NetWeaver, Cloud and Extended Passport
SAP's September 2026 Patch Day fixes 19 notes including CVE-2026-44756 (CVSS 10.0), unauthenticated memory corruption in SAP Extended Passport Processing kernels.
SAP shipped 19 new security notes plus one update across NetWeaver, S/4HANA, Integration Suite, Commerce Cloud, and Cloud Application Programming Model. Top issues include CVE-2026-44756 (CVSS 10.0 memory corruption in SAP Extended Passport Processing across many KERNEL and Web Dispatcher versions), CVE-2026-58240 (CVSS 9.8 missing authentication in NetWeaver Message Server), CVE-2026-76969 (CVSS 9.4 credential disclosure in CAP library sap/cds-mtxs), and CVE-2026-66768 (CVSS 9.0 access control flaw in SAP GUI for Java). No exploitation is reported; organizations running affected kernels are urged to patch urgently.
- Four critical fixes: CVE-2026-44756, CVE-2026-58240, CVE-2026-76969, CVE-2026-66768
- High-severity fixes include XXE in Integration Suite TPM and Log4j misconfiguration in Commerce Cloud
- August note CVE-2026-58243 privilege escalation in ABAP Developer Tools updated
- Fixes also cover SSRF, SQL injection, deserialization, CSRF, and CRLF injection issues
- CVEs
- CVE-2026-44756CVE-2026-58240CVE-2026-76969CVE-2026-66768CVE-2026-58243CVE-2026-76958CVE-2026-76967CVE-2026-66767CVE-2026-2332CVE-2026-76968CVE-2026-44766CVE-2026-76971CVE-2026-34477CVE-2026-76977CVE-2026-76960CVE-2026-76961CVE-2026-76959CVE-2026-76962CVE-2026-76963CVE-2026-58234
- Vendors
- SAP
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-2332 | In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here | 9.1 | 1% | PoC | |
| CVE-2026-34477 | The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete | 6.3 | <1% | ||
| CVE-2026-44756 | Unauthenticated buffer overflow in SAP Kernel Extended Passport (EPP) processing | 10.0 | <1% | ||
CVE-2026-44766+4 related CVEs | Authenticated SQL Injection in SAP S/4HANA Intercompany Matching and Reconciliation | 6.5 group max | <1% | ||
| CVE-2026-58234 | Privileged XML Entity Expansion DoS in SAP Process Integration SOAP Adapter | 2.2 | <1% | ||
| CVE-2026-58240 | Unauthenticated Component Registration Flaw in SAP NetWeaver Message Server | 9.8 | <1% | ||
| CVE-2026-58243 | SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute… | 8.8 | <1% | ||
| CVE-2026-66767 | Unauthenticated Session Hijack via Buffered Request Replay in SAP NetWeaver AS for ABAP | 7.7 | <1% | ||
| CVE-2026-66768 | Trust Level Policy Bypass Enables RCE in SAP GUI for Java | 9.0 | <1% | ||
| CVE-2026-76958 | XXE Injection in SAP Integration Suite Allows Sensitive File Read via Logs | 8.5 | <1% | ||
CVE-2026-76967+1 related CVE | Deserialization flaw allows local code execution in SAP NetWeaver Business Client | 7.8 group max | <1% | ||
| CVE-2026-76968 | Authenticated Information Disclosure in SAP Web Dispatcher, ICM and Content Server | 6.5 | <1% | ||
| CVE-2026-76969 | Unauthenticated Credential Theft and Tenant Data Tampering in SAP @sap/cds-mtxs | 9.4 | <1% | ||
| CVE-2026-76971 | Authenticated SSRF in SAP Manufacturing Integration and Intelligence (MII) | 6.5 | <1% | ||
| CVE-2026-76977 | Unauthenticated frame-origin allowlist bypass in SAP UI5 (clickjacking risk) | 4.3 | <1% |
From the original article
4 min read at cybersecuritynews.com
SAP has released its September 2026 Security Patch Day updates, delivering 19 new security notes and one update to a previously issued note. The patches address vulnerabilities across SAP NetWeaver, SAP Extended Passport Processing, SAP Cloud Application Programming Model, SAP S/4HANA, SAP Integration Suite, SAP Commerce Cloud, and other enterprise products. The most severe issue […]
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.