Search: “SAP”

705 items

Searchkeyword smart Sortlatest hot importance relevance

DomainAll Cyber AIWindow24h 3d 7d 30d AllIn the wild Important only Show duplicates

CategoryAll Vulnerability 234 Industry 105 Exploit / PoC 78 Ransomware 77 Policy & legal 44 Data breach 40 Malware 26 AI industry 16 Threat actor 16 AI tools & infra 15 Phishing & fraud 14 Advisory 14 AI research 8 Tools 8

SeverityAll critical 425 high 100 medium 50 low 85 info 45

SAP Security Updates September 2026 – Critical Flaws Patched in SAP NetWeaver, Cloud and Extended Passport

SAP's September 2026 Patch Day fixes 19 notes including CVE-2026-44756 (CVSS 10.0), unauthenticated memory corruption in SAP Extended Passport Processing kernels.

SAP shipped 19 new security notes plus one update across NetWeaver, S/4HANA, Integration Suite, Commerce Cloud, and Cloud Application Programming Model. Top issues include CVE-2026-44756 (CVSS 10.0 memory corruption in SAP Extended Passport Processing across many KERNEL and Web Dispatcher versions), CVE-2026-58240 (CVSS 9.8 missing authentication in NetWeaver Message Server), CVE-2026-76969 (CVSS 9.4 credential disclosure in CAP library sap/cds-mtxs), and CVE-2026-66768 (CVSS 9.0 access control flaw in SAP GUI for Java). No exploitation is reported; organizations running affected kernels are urged to patch urgently.

Cyber Security NewsSep 8, 11:19 UTC · 8d agoVulnerability CVE-2026-44756 CVE-2026-58240 CVE-2026-76969+17 CVEs

SAP unveils its financial results and increases revenue, profit outlook

Help Net SecurityJul 22, 00:00 UTC · Jul 22, 2021Industry

SAP April 2018 Security Patch Day address critical flaws in web browser controls in SAP Business Client

Security AffairsApr 12, 06:14 UTC · Apr 12, 2018Vulnerability CVE-2017-7668 CVE-2018-2408 CVE-2018-2409+8 CVEs

SAP unveils Autonomous Enterprise for AI-driven business operations

Help Net SecurityMay 12, 00:00 UTC · May 12, 2026Policy & legal

Why SAP systems need to be brought into the cybersecurity fold

Help Net SecurityAug 11, 00:00 UTC · Aug 11, 2022Ransomware

SAP September 2026 Security Update Fixes 4 Critical Vulnerabilities and 15 Other Flaws

SAP's September 2026 Patch Tuesday ships 19 security notes, including four criticals led by a CVSS 10.0 memory-corruption flaw in Extended Passport Processing.

SAP released 19 new Security Notes plus one update, fixing four critical vulnerabilities and 15 additional flaws. The most urgent is CVE-2026-44756 (CVSS 10.0), memory corruption in Extended Passport (EPP) Processing affecting many SAP Kernel and Web Dispatcher releases. Other criticals include CVE-2026-58240 (NetWeaver Message Server missing authentication, 9.8), CVE-2026-76969 (credential disclosure in CAP sap/cds-mtxs, 9.4), and CVE-2026-66768 (improper access control in SAP GUI for Java, 9.0). High-severity fixes cover XXE in Integration Suite Trading Partner Management, deserialization in NetWeaver Business Client, and memory corruption in NetWeaver AS for ABAP.

GBHackersSep 8, 10:24 UTC · 8d agoVulnerability CVE-2026-44756 CVE-2026-58240 CVE-2026-76969+8 CVEs1

SAP and Google Cloud expand collaboration to advance enterprise AI development

Help Net SecurityMay 11, 00:00 UTC · May 11, 2023Industry

Clients across industries choosing to run their SAP software workloads on IBM Cloud

Help Net SecurityOct 23, 00:00 UTC · Oct 23, 2020Industry

Alfresco's SAP integration with SAP S/4 HANA reduces storage costs and improves information sharing

Help Net SecurityAug 19, 00:00 UTC · Aug 19, 2020Industry

HPE and SAP partner to deliver SAP HANA Enterprise Cloud with HPE GreenLake

Help Net SecurityAug 7, 00:00 UTC · Aug 7, 2020Industry

Onapsis expands security for SAP Business Technology Platform

Help Net SecuritySep 25, 00:00 UTC · Sep 25, 2024Ransomware

SAP systems are targeted within 72 hours after updates are released

Security AffairsApr 6, 17:22 UTC · Apr 6, 2021Ransomware in the wildCVE-2010-5326 CVE-2018-2380 CVE-2016-3976+3 CVEs

SAP partners with Red Hat to enhance intelligent business operations

Help Net SecurityDec 11, 14:50 UTC · Dec 11, 2023Industry

SAP Patches CVSS 10.0 Kernel Flaw Enabling Unauthenticated Remote Code Execution

SAP patched CVE-2026-44756 (CVSS 10.0), an unauthenticated kernel memory corruption allowing OS command execution, plus three other critical flaws.

SAP's September security updates include CVE-2026-44756 (OVERPASS, CVSS 10.0), a missing boundary validation during deserialization of Extended Passport (EPP) data in the SAP kernel, enabling unauthenticated attackers to run arbitrary OS commands with SAP administrative privileges. Also patched: CVE-2026-58240 (S4GET, CVSS 9.8), a missing authentication check in SAP NetWeaver Message Server yielding RCE as <sid>adm; CVE-2026-76969 (9.4), credential disclosure in SAP Cloud Application Programming Model multi-tenant apps; and CVE-2026-66768 (9.0), improper access control in SAP NetWeaver SAP GUI for Java. Onapsis, which discovered the flaws, says none have been exploited to date and recommends prioritizing internet-facing SAP systems.

The Hacker NewsSep 9, 06:25 UTC · 7d agoVulnerability CVE-2026-44756 CVE-2026-58240 CVE-2026-76969+1 CVEs

New Onapsis platform updates enhance visibility and protection across SAP landscapes

Help Net SecurityNov 21, 00:00 UTC · Nov 21, 2025Ransomware

90% of the SAP customers exposed to hack due to 13 Year

Security AffairsApr 29, 17:14 UTC · Apr 29, 2018Vulnerability

SAP Security Notes

Security AffairsFeb 15, 15:14 UTC · Feb 15, 2018Vulnerability CVE-2018-2368 CVE-2018-2380 CVE-2018-2369+1 CVEs

SAP Security Notes fixes SAP POS flaw in about 500 billion installations

Security AffairsJul 12, 05:35 UTC · Jul 12, 2017Exploit / PoC

AppDynamics SAP Peak: Providing visibility into SAP environments with real-time business context

Help Net SecurityAug 18, 00:00 UTC · Aug 18, 2020Industry

Onapsis Secure RISE Accelerator streamlines security elements of modern SAP deployments

Help Net SecurityNov 19, 00:00 UTC · Nov 19, 2024Policy & legal

Three Ivanti Wavelink applications now available on SAP Store

Help Net SecurityFeb 5, 13:58 UTC · Feb 5, 2024Industry

Critical bug in SAP TREX affects SAP HANA and other applications

Security AffairsApr 13, 11:14 UTC · Apr 13, 2017Vulnerability CVE-2017-7691

SAP partners with Onapsis to mitigate active threats against unprotected SAP applications

Help Net SecurityFeb 1, 12:25 UTC · Feb 1, 2024Ransomware in the wild

Experts warn of scanning activity for critical SAP SolMan flaw

Security AffairsJan 21, 16:05 UTC · Jan 21, 2021Exploit / PoC CVE-2020-6207

Critical SAP Recon flaw exposes thousands of system to full take over

Security AffairsJul 14, 10:08 UTC · Jul 14, 2020Vulnerability in the wildCVE-2020-6287

Censia Talent Intelligence Platform is now an SAP-Endorsed App, available on SAP App Center

Help Net SecurityJun 8, 00:00 UTC · Jun 8, 2020Industry

SAP security fixes address Critical flaw in SAP HANA XSA

Security AffairsFeb 14, 15:26 UTC · Feb 14, 2019Vulnerability

95 percent of SAP systems were exposed to vulnerabilities

Security AffairsMay 9, 16:00 UTC · May 9, 2015Vulnerability

SAP warns of maximum severity 'OVERPASS' kernel vulnerability

SAP's September 2026 patches fix maximum-severity kernel flaw CVE-2026-44756 (OVERPASS), letting unauthenticated attackers execute commands on 10,000+ internet-facing SAP systems.

SAP's September 2026 Patch Tuesday addresses 20 vulnerabilities, headlined by CVE-2026-44756, a buffer overflow in the Extended Passport Protocol (EPP) library of the SAP Kernel dubbed OVERPASS by Onapsis researchers. Unauthenticated attackers can gain administrative command execution via SAP Internet Communication Manager; Onapsis counted more than 10,000 internet-facing SAP systems. SAP also fixed CVE-2026-58240 (S4GET), a critical missing-authentication flaw in the NetWeaver Message Server enabling unauthenticated remote code execution as <sid>adm. Since November 2021, CISA has added 14 SAP flaws to its actively exploited list, three abused by ransomware gangs.

BleepingComputerSep 8, 14:55 UTC · 8d agoVulnerability 2 sources CVE-2026-44756 CVE-2026-58240 CVE-2026-58231

SAP Patches Maximum Severity “Overpass” Flaw

Onapsis warns over 10,000 internet-facing SAP systems may be exposed to maximum-severity unauthenticated RCE flaw CVE-2026-44756 in SAP Extended Passport.

Onapsis Research Labs discovered CVE-2026-44756, a memory corruption flaw in SAP Extended Passport (EPP) processing caused by missing boundary validation during deserialization. The bug is reachable from the SAP GUI and RFC layers, is remotely exploitable without authentication by default, and could let attackers run arbitrary OS commands with SAP administrative privileges. No active exploitation was observed at publication. Onapsis also flagged critical S4GET bug CVE-2026-58240 (CVSS 9.8) in the S/4HANA Message Server, credential disclosure CVE-2026-76969 in SAP CAP, and improper access control CVE-2026-66768 in NetWeaver.

Infosecurity MagazineSep 9, 08:15 UTC · 7d agoVulnerability CVE-2026-44756 CVE-2026-58240 CVE-2026-76969+1 CVEs

SAP and Google Cloud join forces to provide customers with generative AI capabilities

Help Net SecurityAug 29, 00:00 UTC · Aug 29, 2023Model release

Critical flaw gives attackers control of vulnerable SAP business applications

Help Net SecurityJul 14, 00:00 UTC · Jul 14, 2020Vulnerability CVE-2020-6287

2026-011: Critical Vulnerabilities in SAP Kernel and NetWeaver Message Server

SAP patched two critical flaws, OVERPASS (CVE-2026-44756, CVSS 10.0) and S4GET (CVE-2026-58240), allowing unauthenticated attackers to execute OS commands on SAP hosts.

On SAP's September 2026 Security Patch Day, SAP released Security Notes 3747649 and 3759472 fixing two critical unauthenticated remote vulnerabilities found by Onapsis. CVE-2026-44756 ('OVERPASS', CVSS 10.0) is a memory corruption flaw in Extended Passport (EPP) deserialisation in the SAP Kernel; CVE-2026-58240 ('S4GET', CVSS 9.8) is a missing authentication check in the NetWeaver Message Server that lets attackers register as trusted cluster nodes. Successful exploitation of either can yield OS command execution as the SAP service account, leading to full system and business data compromise, and CERT-EU urges immediate patching. No in-the-wild exploitation is reported.

CERT-EU AdvisoriesSep 9, 00:00 UTC · 7d agoVulnerability CVE-2026-44756 CVE-2026-58240