SAP Security Patch Day September 2026 | RedRays

Executive Summary

• Maximum severity memory corruption: CVE-2026-44756 (CVSS 10.0) in SAP Extended Passport processing can be reached over the network by an unauthenticated attacker with no user interaction. Because the scope changes, a successful attack reaches past the vulnerable component and fully compromises confidentiality, integrity and availability. This is the only note in the release that scores a perfect 10.0.
• Unauthenticated Message Server access: CVE-2026-58240 (CVSS 9.8) removes the authentication requirement on an SAP Message Server request path, so anyone who can reach the service needs no credentials at all. Since the Message Server coordinates the application servers of an ABAP system, review port exposure and the ms/acl_info access list while the patch is scheduled.
• Credential disclosure in multitenant CAP applications: CVE-2026-76969 (CVSS 9.4) exposes credentials in applications built on the SAP Cloud Application Programming Model. In a multitenant deployment the consequences are not confined to one tenant, so rotate anything that may have leaked instead of treating the patch as sufficient on its own.
• Improper access control in SAP GUI for Java: CVE-2026-66768 (CVSS 9.0) lets a low-privileged attacker act beyond their permissions once a user interacts with prepared content, with a changed scope and full impact on all three metrics. The correction ships with the desktop client, so the rollout takes longer than a server-side note and should start now.

Memory Corruption Vulnerability in SAP Extended Passport (EPP) Processing

SAP Extended Passport processing contains a memory corruption flaw that an unauthenticated attacker can reach over the network without any user interaction. Extended Passport data travels with requests so that SAP components can trace a call end to end, which puts the parsing code directly on the path of ordinary inbound traffic rather than behind an application function. Because the scope changes, a successful attack reaches beyond the vulnerable component itself and compromises confidentiality, integrity and availability completely. This is the only CVSS 10.0 note in the release, so it belongs at the top of the queue.

Missing Authentication Check in SAP NetWeaver (Message Server)

The SAP Message Server accepts a request path that performs no authentication check, so an attacker who can reach the service over the network needs neither credentials nor user interaction. The Message Server coordinates the application servers of an ABAP system and holds the information those servers use to find each other, which makes it a valuable target whenever its ports are reachable beyond the trusted server segment. Confidentiality, integrity and availability are all fully affected. Because the internal Message Server port is not meant to be exposed outside that segment, review the port exposure and the ms/acl_info access control list while the patch is being scheduled.

Credential Disclosure in Multitenant Applications Using SAP Cloud Application Programming Model

Multitenant applications built on the SAP Cloud Application Programming Model can disclose credentials to an unauthenticated caller over the network. The impact pattern is unusual, since confidentiality is rated low while integrity and availability are both rated high. That combination points at leaked material which matters less for what it reveals than for what it lets an attacker do next. In a multitenant deployment the consequences are not limited to the tenant where the flaw is triggered, so treat any credential that may have been exposed as compromised and rotate it after patching rather than assuming the correction alone closes the issue.

Improper Access Control in SAP NetWeaver (SAP GUI for Java)

SAP GUI for Java fails to enforce an access control decision, so a low-privileged attacker who persuades a user to interact with prepared content can act beyond the permissions that user should have. The scope changes, which means the consequences are not confined to the client component, and confidentiality, integrity and availability are all fully affected. Because exploitation runs through the desktop client rather than through the server, closing the gap depends on distributing a new client version to every workstation. That usually takes longer than a server-side note, so start the rollout now.

Privilege Escalation Vulnerability in SAP ABAP Developer Tools

SAP ABAP Developer Tools allow a low-privileged authenticated user to escalate privileges over the network with no user interaction, which fully compromises confidentiality, integrity and availability. ADT exposes the ABAP repository through HTTP services, so the accounts in scope are not only the developers working in Eclipse but anyone who can reach those services. This note carries an August date alongside the September release date, so systems patched in the previous cycle should be checked against the current version of the note rather than assumed to be covered already.

XML External Entity Vulnerability in SAP Integration Suite

An XML external entity flaw in SAP Integration Suite lets a low-privileged authenticated attacker make the XML parser resolve entities it should refuse. Because the scope changes, the data reachable through the parser is not limited to the context that submitted the document, and confidentiality is fully affected while availability takes a limited hit. Integration content routinely carries XML supplied by partners and by other systems, so the untrusted input arrives through the normal business path rather than an unusual one. Review which integration flows accept externally supplied XML while the patch is applied.

Insecure Deserialization in SAP NetWeaver Business Client

SAP NetWeaver Business Client deserializes data without validating it first, so an attacker with local access and low privileges can supply a crafted object and take full control of confidentiality, integrity and availability. The attack vector is local rather than network, which lowers the score, although it does not make the issue theoretical: shared workstations, terminal servers and any foothold already established on a user machine all satisfy that condition. As with the SAP GUI note above, the correction travels with the client, so plan the rollout across the desktop estate.

Memory Corruption Vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform

A memory corruption flaw in the RFC layer of SAP NetWeaver Application Server ABAP can be triggered over the network by an unauthenticated attacker, though the high attack complexity means conditions outside the attacker’s control have to line up first. Confidentiality and integrity are fully affected while availability is only partly affected. RFC carries system-to-system communication across an ABAP landscape, so the exposed surface follows wherever gateway and RFC ports are reachable. Check the note for the delivery vehicle, because corrections in this area are commonly shipped with the kernel and therefore belong in a kernel maintenance window.

CRLF Injection via Jetty Components in SAP Commerce Cloud (Search and Navigation)

The Search and Navigation component of SAP Commerce Cloud bundles Jetty, and the bundled version allows carriage return and line feed sequences to be injected into responses. An unauthenticated attacker can reach the flaw over the network, although the attack complexity is high, and a successful attempt fully affects confidentiality and integrity. The CVE identifier belongs to the upstream Jetty project rather than to SAP, which usually indicates that the correction is a component upgrade instead of a change to SAP code. Track it together with the Log4j note below, since both come from the same component in the same product.

Server-Side Request Forgery in SAP Manufacturing Integration and Intelligence

SAP Manufacturing Integration and Intelligence contains a server-side request forgery that a low-privileged authenticated attacker can use once a user interacts with a prepared request. The scope changes and all three impact metrics are rated low. SAP classifies this note as Consulting rather than Program error, which means the correction arrives as configuration guidance instead of code, so applying a support package will not close it on its own and the steps in the note have to be carried out. MII also accounted for six notes in the August cycle, so the component deserves a full review rather than note-by-note patching.

SQL Injection Vulnerability in SAP S/4HANA (Intercompany Matching and Reconciliation)

An SQL injection flaw in the Intercompany Matching and Reconciliation area of SAP S/4HANA lets a low-privileged authenticated user read data the application should withhold from them. Confidentiality is fully affected while integrity and availability are untouched, which fits an injection that can read from the database but not modify it. Because the affected area handles intercompany financial data, the records at risk are the ones auditors ask about, so the business case for patching is stronger than the score alone suggests.

Information Disclosure in SAP Web Dispatcher, Internet Communication Manager and SAP Content Server

SAP Web Dispatcher, the Internet Communication Manager and SAP Content Server share a flaw that discloses information to a low-privileged attacker over the network, with confidentiality fully affected and no impact on integrity or availability. All three components sit at the network edge of an SAP landscape and frequently terminate connections that originate outside the server segment, so the population of accounts able to reach them is wider than for an application-level note. Since the correction touches shared code, several components may need to move to the same patch level together.

Security Misconfiguration via Apache Log4j in SAP Commerce Cloud (Search and Navigation)

The Search and Navigation component of SAP Commerce Cloud ships an Apache Log4j configuration that leaves the component exposed. An unauthenticated attacker can act over the network under high-complexity conditions, and integrity is fully affected while confidentiality and availability are not. The CVE identifier again comes from the upstream project rather than from SAP. Together with the Jetty note above, this is the second third-party component issue in the same product this month, so the practical response is to review the whole dependency set of that component instead of applying two isolated notes.

Missing Authorization Check in Application Server ABAP of SAP NetWeaver and ABAP Platform

A function in the internationalization area of SAP NetWeaver Application Server ABAP runs without a proper authorization check, so a low-privileged authenticated user can read a limited amount of data they should not have access to. Integrity and availability are not affected. The score is modest, yet missing authorization checks remain the most common finding class in ABAP systems, and every one of them widens what an already authenticated account can reach. Treat it as part of the broader authorization review rather than as an isolated correction.

Missing Authorization Check in SAP S/4HANA (Manage Bank Chains App)

The Manage Bank Chains application in SAP S/4HANA misses an authorization check, and the impact falls on availability alone at a low level, with no effect on confidentiality or integrity. A low-privileged authenticated user can therefore disturb the service without reading or altering data. Bank chain master data drives payment routing, so an availability problem in this application has a direct operational cost even though the score sits at the lower end of the release.

Cross-Site Request Forgery in SAP S/4HANA (Finance for Advanced Payment Management)

Advanced Payment Management in SAP S/4HANA accepts a state-changing request without verifying that the user intentionally issued it. A low-privileged attacker who gets an authenticated user to load prepared content can therefore act as that user, which affects confidentiality and integrity at a low level. This is one of three cross-site request forgery notes in the same component this month, and it is the only one of the three that also touches confidentiality, so apply the set together rather than picking one.

Cross-Site Request Forgery in SAP S/4HANA (Finance for Advanced Payment Management)

A second cross-site request forgery in Advanced Payment Management lets a low-privileged attacker trigger an action on behalf of an authenticated user who interacts with prepared content. Integrity is affected at a low level while confidentiality and availability are untouched. It belongs to the same group of three corrections in this component, so apply it alongside notes 3365311 and 3365276 instead of scheduling the three separately.

Cross-Site Request Forgery in SAP S/4HANA (Finance for Advanced Payment Management)

The third cross-site request forgery note for Advanced Payment Management follows the same pattern as the previous two: a low-privileged attacker causes an authenticated user to submit an unintended state-changing request, and integrity is affected at a low level. Because the three notes cover related entry points in one component, patching only part of the set leaves the remaining paths open.

Clickjacking Vulnerability in SAPUI5 (Frame Options Allowlist)

The frame options allowlist in SAPUI5 can be bypassed, so an unauthenticated attacker is able to embed an application inside a frame under their control and trick a user into clicking something other than what they believe they are clicking. Integrity is affected at a low level. Because the weakness sits in the framework rather than in one application, every SAPUI5 screen inherits it, including content served through the Fiori launchpad. Review the allowlist configuration after patching instead of relying on the default.

Denial of Service Vulnerability in SAP Process Integration (SOAP Adapter)

The SOAP adapter in SAP Process Integration can be pushed into a limited denial of service by an attacker who already holds high privileges, and only under high-complexity conditions. Confidentiality and integrity are untouched while availability is partly affected, which is why this note sits at the bottom of the release. The prerequisites are demanding enough that it can be folded into the regular maintenance cycle rather than handled on its own.