SAP Security Patches

Memory Corruption via Malformed Extended Passport Header

Missing boundary validation during deserialization of Extended Passport (EPP) data. A crafted network packet with a malformed EPP header triggers a memory safety violation. No authentication required, low attack complexity, network reachable.

Missing Authentication for Message Server Internal Registration

Insufficient validation of authenticity of application server components during internal registration. An unauthenticated remote attacker could register a rogue application server into the SAP system group, enabling traffic interception and potential remote code execution.

Memory Corruption via Session Packet Replay in AS ABAP

Session hijacking via specially crafted packet reprocessing under timing conditions. A second kernel-level memory corruption vulnerability in September's release cycle.

Information Disclosure via Administrative Interface

Low-privileged user can access administrative functionality and system state information across three components: Web Dispatcher, Internet Communication Manager, and Content Server.

Missing Authorization Check in ABAP Platform

Authorization check bypass in Application Server ABAP. An authenticated attacker with minimal privileges could access unauthorized functionality.

Credential Exposure in CAP Multitenant Extension Library

Sensitive service binding credentials exposed via specially crafted requests in multitenant CAP applications using the cds-mtxs library. SAP BTP Cloud Foundry has blocked affected endpoints at the platform level, but customers must update the library and redeploy their applications.

Improper Access Control in SAP GUI for Java

Trust level policy not correctly enforced for certain functions in SAP GUI for Java. A low-privileged attacker could gain unauthorized access or command execution after user interaction with a crafted payload.

XML External Entity Injection in Integration Suite

Insufficient XML validation in SAP Integration Suite components allows XML External Entity (XXE) injection. An attacker could read sensitive files from the integration server, initiate server-side requests, or disrupt XML processing.

Insecure Deserialization in SAP NetWeaver Business Client

Arbitrary code execution possible via insecure deserialization of crafted data in locally stored files. Client-side component flaw requiring local access or a malicious file delivery mechanism.

Regular Expression Denial of Service in Supply Protection

Regular Expression Denial of Service (ReDoS) via a vulnerable third-party component in the Manage Supply Protection app. Crafted input triggers catastrophic regex backtracking, causing service unavailability.

HTTP Request Smuggling via Bundled Jetty Component

Bundled Jetty HTTP server component incorrectly handles chunk extension parsing, enabling HTTP request smuggling between the front-end proxy and the Jetty back-end. Allows an attacker to poison shared connection caches or bypass security controls.

SQL Injection in Intercompany Matching and Reconciliation

Malicious input injection allows access to sensitive information without proper validation in the Intercompany Matching and Reconciliation module. An authenticated attacker can craft SQL to read backend financial data.

Server-Side Request Forgery in SAP MII

SAP MII server initiates arbitrary outbound requests based on user-supplied input. SAP guidance requires nine manual hardening activities in addition to the note patch.

Apache Log4j Configuration Vulnerability in Commerce Cloud

Apache Log4j configuration vulnerability in the SAP Commerce Cloud Search and Navigation component. Distinct from the Jetty CRLF issue in the same module (Note 3791068).

Clickjacking via Frame Options Misconfiguration in SAPUI5

Frame options allowlist misconfiguration in SAPUI5 allows UI redressing attacks (clickjacking). An attacker could embed a SAPUI5 application in an iframe to trick users into unintended actions.

Missing Authorization Check in Manage Bank Chains

Missing authorization check in the bank chain management application in SAP S/4HANA. An authenticated user could access bank chain data without the appropriate authorization object.

Cross-Site Request Forgery in Advanced Payment Management (1 of 3)

Cross-Site Request Forgery vulnerability in SAP S/4HANA Advanced Payment Management. One of three CSRF notes released this month for the same application module.

Cross-Site Request Forgery in Advanced Payment Management (2 of 3)

Second Cross-Site Request Forgery vulnerability in SAP S/4HANA Advanced Payment Management. Different endpoint from CVE-2026-76961 but same application module.

Cross-Site Request Forgery in Advanced Payment Management (3 of 3)

Third Cross-Site Request Forgery vulnerability in SAP S/4HANA Advanced Payment Management. Third distinct endpoint found unprotected against CSRF in this release cycle.

Denial of Service via Crafted SOAP Adapter Input

Service disruption in the SAP Process Integration SOAP Adapter via specially crafted input. Requires specific conditions to trigger and has minimal impact scope.