SAP Security Updates September 2026 – Critical Flaws Patched in SAP NetWeaver, Cloud and Extended Passport

In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html * https://w4ke.info/2025/10/29/funky-chunks-2.html Jetty terminates chunk extension parsing at \r\n inside quoted strings instead of treating this as an error. POST / HTTP/1.1 Host: localhost Transfer-Encoding: chunked 1;ext="val X 0 GET /smuggled HTTP/1.1 ... Note how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.

The fix for CVE-2025-68161 https://logging.apache.org/security.html#CVE-2025-68161 was incomplete: it addressed hostname verification only when enabled via the log4j2.sslVerifyHostName https://logging.apache.org/log4j/2.x/manual/systemproperties.html#log4j2.sslVerifyHostName system property, but not when configured through the verifyHostName https://logging.apache.org/log4j/2.x/manual/appenders/network.html#SslConfiguration-attr-verifyHostName attribute of the element. Although the verifyHostName configuration attribute was introduced in Log4j Core 2.12.0, it was silently ignored in all versions through 2.25.3, leaving TLS connections vulnerable to interception regardless of the configured value. A network-based attacker may be able to perform a man-in-the-middle attack when all of the following conditions are met: * An SMTP, Socket, or Syslog appender is in use. * TLS is configured via a nested element. * The attacker can present a certificate issued by a CA trusted by the appender's configured trust store, or by the default Java trust store if none is configured. This issue does not affect users of the HTTP appender, which uses a separate verifyHostname https://logging.apache.org/log4j/2.x/manual/appenders/network.html#HttpAppender-attr-verifyHostName attribute that was not subject to this bug and verifies host names by default. Users are advised to upgrade to Apache Log4j Core 2.25.4, which corrects this issue.

CVE-2026-44756 is a critical (CVSS 10.0) memory-safety flaw — a classic buffer overflow (CWE-120) — in the Extended Passport Protocol (EPP) processing library of SAP Kernel, the core runtime underlying SAP NetWeaver components (SAP's advisories tie the issue to SAP Kernel and the NetWeaver Message Server). An unauthenticated remote attacker can trigger it by sending a crafted network request containing a malformed EPP header to a system that processes EPP traffic. The malformed header causes undefined behavior and abnormal program termination, and SAP's maximum-severity rating plus vendor coverage of the flaw indicate it can enable unauthenticated remote code execution with high impact on confidentiality, integrity, and availability. Any organization running the affected SAP Kernel/NetWeaver components — essentially typical ABAP-stack SAP deployments — is exposed until patched. No public proof-of-concept is known, the flaw is not in CISA KEV, EPSS estimates only a 0.3% chance of exploitation within 30 days (25th percentile), and fixes shipped in SAP's September 2026 Security Patch Day.

Do: Apply the SAP Kernel and NetWeaver Message Server fixes released in SAP's September 2026 Security Patch Day (per the 2026-011 advisory covering this flaw), since specific fixed version numbers are not listed in the available data. As interim mitigation, restrict network access to SAP kernel and message-server services to trusted internal networks and identify any SAP instances exposed to the internet. Check SAP's advisory for the exact patch levels applicable to your kernel releases and prioritize externally reachable systems.

CVE-2026-44766 is a SQL injection flaw (CWE-89) in the Intercompany Matching and Reconciliation (IMR) component of SAP S/4HANA. A low-privileged authenticated user can submit crafted input to certain IMR functions, which is passed to the underlying database without proper validation, allowing malicious queries to execute. An attacker gains unauthorized read access to sensitive information in the database — a high confidentiality impact — with no effect on integrity or availability, and no user interaction is required beyond the attacker's own valid low-privilege session. Only organizations running SAP S/4HANA with the IMR component in use are affected; exposure is internal-facing, since exploitation requires an authenticated account rather than anonymous internet access. There is no public proof of concept, the flaw is not in CISA's KEV catalog, and EPSS of 0.2% (13th percentile) indicates no known exploitation; fixes were shipped as part of SAP's September 2026 Security Patch Day.

Do: Apply the SAP September 2026 Security Patch Day corrections for S/4HANA IMR, checking the SAP Security Note for this CVE to match the correct patch level to your installed release. Until patched, restrict low-privileged access to the affected IMR functions and review database logs for unexpected or anomalous queries issued by IMR service users.

CVE-2026-58234 is a low-severity denial-of-service flaw in the SOAP Adapter of SAP Process Integration, caused by improper handling of recursive XML entity definitions (CWE-776). An attacker who already holds highly privileged credentials must send specially crafted SOAP requests containing deeply nested entity definitions, which under certain conditions can drive up processor load. The only impact is a temporary, low-severity degradation of system responsiveness; confidentiality and integrity are unaffected, so the attacker gains at most a brief availability impact rather than code execution or data access. Only organizations running SAP Process Integration with the SOAP Adapter enabled are affected, and only via a highly privileged account (legitimate or compromised). No public proof of concept is known, it is not in CISA's KEV catalog, and EPSS puts the 30-day exploitation probability at just 0.2%; the fix shipped in SAP's September 2026 security updates.

Do: Apply the SAP Process Integration fix distributed in the September 2026 SAP Security Patch Day, checking the SAP security note for the exact patched versions rather than assuming current patch levels. Because exploitation requires highly privileged access, restrict and audit which accounts may call the SOAP Adapter and rotate or monitor privileged credentials. Monitor processor load and system responsiveness for anomalies as an interim detection measure.

SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components when they register with the service (CWE-308). An unauthenticated attacker with network access to the affected service can send a crafted registration request to add or impersonate an application server component. Once registered, the attacker can potentially perform unauthorized actions within the SAP application environment, resulting in a high impact on confidentiality, integrity, and availability — reflected in the critical CVSS 9.8 score. Any organization running SAP NetWeaver deployments that rely on the Message Server is affected; the source data does not specify exact affected version ranges. There is no evidence of active exploitation, no public proof-of-concept, and the issue is not in CISA KEV, with EPSS assigning only a ~0.3% 30-day exploitation probability; a fix shipped in SAP's September 2026 Security Patch Day (a release that also patched other critical flaws, including the separately reported 'OVERPASS' SAP Kernel issue).

Do: Apply the SAP NetWeaver Message Server fix from the September 2026 SAP Security Patch Day (referenced as advisory 2026-011) as a priority, since the flaw is unauthenticated and network-triggerable; check SAP's portal for the corrected builds applicable to your release, as no specific version numbers were provided in the source data. Until patching, restrict network access to the Message Server (typically TCP 36xx, e.g., 3600) to trusted application server hosts and internal networks, and verify no message server listener is reachable from the internet. Monitor SAP security notes for updates, as no public exploit exists today.

SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database operations against SAP NetWeaver AS ABAP. Successful exploitation could allow the attacker to read sensitive data, modify application data, and disrupt access for legitimate users, resulting in high impact on confidentiality, integrity, and availability.

SAP NetWeaver Application Server for ABAP and ABAP Platform contains an unauthenticated session-hijacking flaw (CWE-191, incorrect type validation) in which a specially crafted network packet causes the server to reprocess a previously buffered user request. Because the flaw can only be triggered under narrow timing conditions, an unauthenticated remote attacker may be able to replay another user's buffered request and take over that user's session, gaining high-impact access to the victim's confidentiality and integrity with only low impact on availability. Any organization running SAP NetWeaver AS for ABAP or ABAP Platform is potentially affected, though the attack surface depends on whether the affected service is reachable from untrusted networks. No public proof-of-concept, CISA KEV listing, or confirmed exploitation is known; EPSS currently estimates only a 0.3% probability of exploitation within 30 days.

Do: Apply the SAP September 2026 Security Patch Day corrections for NetWeaver AS for ABAP and ABAP Platform, using SAP's advisory to identify the note and patch level matching your installed releases. Until patched, restrict network access to the affected SAP application server services from untrusted networks, and monitor for anomalous session reuse or unexpected session takeover. Given the high attack complexity and lack of known exploitation, prioritize patching within normal monthly maintenance windows unless the service is internet-exposed.

SAP GUI for Java (CWE-807) fails to correctly enforce its trust level policy when certain functions are invoked from a connected backend system, meaning the client relies on untrusted backend input when making security decisions. To exploit it, an attacker needs low-privileged access to a connected backend (for example, a compromised or malicious SAP backend) and must manipulate that backend to trigger the affected functionality, which also requires interaction from the logged-in user (CVSS UI:R). Successful exploitation yields arbitrary command execution on the victim's workstation, with the changed-scope vector (S:C) allowing a backend-level foothold to break out onto the end-user machine and seriously impacting its confidentiality, integrity, and availability. Anyone running SAP GUI for Java to connect to SAP backends is exposed, particularly in scenarios where less-trusted or low-privileged users can influence the backend their colleagues connect to. There is no known public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates only a 0.3% chance of exploitation in the next 30 days, so no in-the-wild exploitation is currently known; a fix shipped as part of SAP's September 2026 security patch day.

Do: Deploy the SAP GUI for Java patch released with SAP's September 2026 security updates, checking the SAP advisory for the exact affected and fixed versions for your release line. Inventory endpoints running SAP GUI for Java (especially macOS/Linux desktops) and the backends they connect to, prioritizing users who connect to backends accessible to low-privileged or external users. As an interim mitigation, restrict low-privileged accounts' ability to invoke the affected backend functions and treat backend compromise as a path to client workstation takeover when assessing risk.

SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components, permitting XML external entity (XXE) injection (CWE-611). An attacker with low-privilege (authenticated) access can submit specially crafted XML payloads containing malicious external entity declarations over the network, with no user interaction required. Successful exploitation lets the attacker read sensitive files from the server, with the contents exposed through monitoring or logging output, and can also cause resource exhaustion; confidentiality impact is high, availability impact is low, and there is no integrity impact (CVSS 3.1 score 8.5, scope changed). Any organization running SAP Integration Suite, a cloud-delivered platform whose tenants consume SAP-managed components, is affected until the September 2026 SAP security updates are applied. No exploitation has been observed so far: there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS assigns only a 0.2% probability of exploitation within the next 30 days.

Do: Apply the SAP Integration Suite fixes released in the September 2026 SAP Security Patch Day, locating the corresponding SAP security note via CVE-2026-76958 for the exact component and version details (not disclosed in this data). Because file contents may be exposed through monitoring or logging output, review relevant logs for signs of XXE probing or leaked sensitive data and treat affected log stores as potentially containing sensitive information. Additionally, restrict low-privilege access to XML-accepting endpoints and disable or limit external entity resolution where configuration options allow.

SAP S/4HANA Finance (Advanced Payment Management) does not sufficiently protect certain requests against cross-site request forgery (CWE-352). An attacker with low privileges can craft a malicious link or web page, and when an authenticated user interacts with it, the browser issues requests that trigger unintended actions on the web server on the victim's behalf. Successful abuse yields a low impact on confidentiality and integrity, with no impact on availability. Any organization running the Advanced Payment Management component of SAP S/4HANA Finance is affected, with risk concentrated among finance and back-office users who browse other sites while authenticated to the application. There is no public proof-of-concept, no CISA KEV listing, and EPSS estimates only a 0.1% probability of exploitation within 30 days, so no exploitation is currently known.

Do: Determine whether the Advanced Payment Management component is deployed in your SAP S/4HANA Finance landscape and apply the corresponding SAP security note from the September 2026 Patch Day release. Until patched, limit access to the application to necessary finance personnel and caution users about interacting with unsolicited links or pages while authenticated; no other workarounds are documented in the available data.

CVE-2026-76962 is a missing authorization check (CWE-862) in the Manage Bank Chains app of SAP S/4HANA. An authenticated attacker with low privileges can send specially crafted requests that delete specific entries they should not be permitted to access. The impact is limited to a low availability loss from these deletions, with no confidentiality or integrity impact. Only organizations running SAP S/4HANA with the Manage Bank Chains (bank chain management) functionality in use are affected. There is no known public proof-of-concept, the flaw is not listed in CISA KEV, and EPSS puts 30-day exploitation probability at roughly 0.2%, so no exploitation is currently known.

Do: Apply the SAP security patch addressing CVE-2026-76962 from the September 2026 Security Patch Day; consult SAP's advisory for exact supported versions since affected ranges are not stated here. Until patched, review which low-privileged users have access to the Manage Bank Chains app and tighten or restrict their authorizations. Check application logs for unexpected deletion activity targeting bank chain entries to determine whether the issue has been triggered.

CVE-2026-76963 is a missing authorization check (CWE-862) in Application Server ABAP of SAP NetWeaver and ABAP Platform. A low-privileged authenticated user with network access to the affected system can trigger the flaw and gain unauthorized access to sensitive system configuration information, including security-relevant settings and internal system details. The impact is limited to confidentiality (CVSS 4.3 medium); integrity and availability are unaffected. Any organization running SAP NetWeaver AS ABAP or ABAP Platform is potentially affected. As of this analysis there is no known public proof-of-concept, it is not in CISA's KEV catalog, and EPSS estimates only a 0.2% chance of exploitation within 30 days.

Do: Apply the corrective patch released by SAP in its September 2026 Security Patch Day for NetWeaver AS ABAP / ABAP Platform, consulting the SAP advisory for the exact versions covered. Until patched, restrict which low-privileged authenticated users can access the affected Application Server ABAP services and review roles/authorizations for over-provisioning. Check logs for unusual authenticated reads of configuration data by low-privilege users.

SAP NetWeaver Business Client does not sufficiently validate certain locally stored data that it processes at application startup, a flaw classified as CWE-502 (deserialization of untrusted data). An attacker with low privileges on the local system can replace this data with specially crafted content, and when the application is next launched the crafted content is processed with no further user interaction required. Successful exploitation results in arbitrary code execution in the context of the logged-on user, with high impact on the confidentiality, integrity, and availability of the application. Any organization running the SAP NetWeaver Business Client desktop application is affected, and fixes were delivered as part of SAP's September 2026 Security Patch Day. No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known, and EPSS currently estimates only a 0.2% probability of exploitation within 30 days.

Do: Apply the SAP security patch released with the September 2026 Patch Day to all systems running SAP NetWeaver Business Client, checking SAP's advisory for the specific affected and corrected releases. Because exploitation requires low-privileged local access, limit write access to the application's locally stored data/configuration locations and maintain endpoint hardening on workstations running the client. No workarounds are described in the available data, so prompt patching is the primary remediation.

CVE-2026-76968 is an information disclosure flaw (CWE-497) in SAP Web Dispatcher, SAP Internet Communication Manager (ICM), and SAP Content Server in which an authenticated user with only low privileges can reach administrative functionality or interfaces that should be off-limits to them. The attacker triggers the flaw by sending requests over the network to these administrative endpoints using valid low-privileged credentials, requiring no user interaction. By reading the exposed administrative interface, the attacker obtains sensitive information about the system state, which could be used to facilitate further attacks, although integrity and availability are not affected. Any organization running the affected SAP components is exposed, and because ICM is embedded in SAP's application server stack, this potentially touches a very broad base of SAP on-premise and cloud deployments. As of now there is no evidence of exploitation, no public proof-of-concept, and the issue is not in CISA's KEV catalog; fixes were shipped with the SAP September 2026 Security Patch Day updates.

Do: Apply the SAP security fixes released with the September 2026 Security Patch Day (check SAP Note/CVE-2026-76968 for the exact patch levels for Web Dispatcher, ICM and Content Server, as version details are not in this data). Until patching, restrict access to the administrative interfaces of these components using network controls and review which low-privileged users can reach them. Since exploitation requires valid credentials, prioritize review of recently created or over-privileged service and end-user accounts.

CVE-2026-76969 is a critical flaw (CVSS 9.4) in SAP's @sap/cds-mtxs npm package, the multitenancy component of the SAP Cloud Application Programming Model (CAP), which performs insufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker who can reach the affected endpoints can send specially crafted requests that cause the service to disclose sensitive credentials. With those credentials, the attacker can replace or delete tenant data, resulting in high impact to integrity and availability and partial impact to the confidentiality of business data. Only deployments running multitenant CAP applications on @sap/cds-mtxs with extensibility enabled are affected. Exploitation has not been observed: there is no known public proof of concept, the issue is not in CISA KEV, and EPSS estimates only a ~0.3% probability of exploitation within 30 days.

Do: Update the @sap/cds-mtxs dependency in all multitenant CAP applications to the fixed version given in SAP's security advisory for CVE-2026-76969 (part of SAP's September 2026 patch batch) and redeploy the affected applications. Audit whether your CAP applications use multitenancy with extensibility enabled and whether the mtxs endpoints are reachable without authentication, and rotate any tenant-scoped credentials that could have been exposed. As an interim mitigation, restrict network access to the mtxs/sidecar endpoints to trusted callers.

CVE-2026-76971 is a server-side request forgery (SSRF, CWE-918) vulnerability in SAP Manufacturing Integration and Intelligence (MII) that allows an attacker to make the application server initiate arbitrary outbound requests. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C) indicates exploitation requires network access, a low-privileged authenticated session, and user interaction, and if the application processes the attacker-influenced request through its XML/XSL handling, the SSRF can be escalated into script execution. A successful attacker gains low-rated impact on confidentiality, integrity, and availability, consistent with limited script execution within the application's scope rather than full system compromise. Organizations running SAP MII, a specialized manufacturing-integration add-on typically deployed within SAP ERP landscapes at manufacturing sites, are affected; other SAP products patched in the same monthly cycle are not part of this CVE. There is no known public proof of concept, the flaw is not in CISA's KEV catalog, EPSS estimates roughly 0.1% probability of exploitation within 30 days, and no in-the-wild exploitation is known; fixes were released as part of SAP's September 2026 Security Patch Day.

Do: Apply the SAP Manufacturing Integration and Intelligence update from SAP's September 2026 Security Patch Day, consulting the SAP security note for CVE-2026-76971 for the exact affected and patched versions. Until patching is complete, restrict outbound (egress) network access from MII servers, limit the accounts able to reach the application, and monitor for unexpected outbound connections or XML/XSL processing activity. Because exploitation requires valid low-privileged credentials plus user interaction, also review account provisioning on MII instances.

SAP UI5 does not sufficiently validate the parent frame's origin against its configured allowlist (CWE-1289), allowing framing restrictions to be bypassed. An unauthenticated attacker can host a malicious web page, and if an authenticated victim visits that page and interacts with it, the attacker can trick the victim into performing unintended actions in the UI5 application — a clickjacking-style attack. The result is a low impact on integrity only, with no impact on confidentiality or availability (CVSS 3.1 score 4.3, medium). Any organization running SAP UI5-based frontends, the UI framework underlying SAP Fiori applications, is potentially affected where frame-origin allowlists are relied upon. There is no known public proof-of-concept, the issue is not listed in CISA KEV, and EPSS is 0.2% (13th percentile), indicating exploitation risk is currently low.

Do: Apply the SAP UI5 fix delivered in SAP's September 2026 Security Patch Day and check the SAP note for this CVE for the exact affected and corrected versions. Review whether your UI5 applications depend on cross-origin framing and parent-frame origin allowlists, and restrict frame-ancestors/framing configuration where cross-origin embedding is not needed. Since exploitation requires an authenticated user to visit and interact with an attacker-controlled page, user awareness and standard web controls (e.g., validating external links) provide practical mitigation; expected impact is limited to unintended user actions, not data disclosure.