Multiple Vulnerabilities in SAP Products · CIAD-2026-0045

CERT-In Advisory CIAD-2026-0045

Multiple Vulnerabilities in SAP Products

Original Issue Date: September 10, 2026

Severity Rating: High

Software Affected

SAP Extended Passport (EPP) Processing
SAP NetWeaver (Message Server)
SAP Cloud Application Programming Model (CAP)
SAP NetWeaver (SAP GUI for Java)
SAP ABAP Developer Tools
SAP Integration Suite
SAP NetWeaver Business Client
SAP NetWeaver Application Server for ABAP and ABAP Platform
SAP Commerce Cloud (Search And Navigation)
SAP Web Dispatcher, Internet Communication Manager and SAP Content Server
SAP S/4HANA (Intercompany Matching and Reconciliation)
SAP Manufacturing Integration and Intelligence
SAPUI5 (Frame Options Allowlist)
SAP S/4HANA (Finance for Advanced Payment Management)
SAP S/4HANA (Manage Bank Chains app)
SAP NetWeaver and ABAP Platform
SAP Process Integration (SOAP Adapter)

Overview

Multiple vulnerabilities have been reported in various SAP products which could allow a remote attacker to execute arbitrary code, elevate privileges, obtain sensitive information, bypass security restrictions, cause memory corruption, cause denial of service (DoS) conditions, gain unauthorized access, manipulate application data, and perform server-side request forgery (SSRF) on the targeted system.

Target Audience:

Users of SAP products.

Risk Assessment:

High risk of complete system compromise, unauthorized access, and denial of service.

Impact Assessment:

Potential for execute arbitrary code, elevate privileges, disclose sensitive information, and cause denial of service (DoS) conditions.

Description

SAP provides a wide range of enterprise software solutions, including application servers, integration suites, and business process management tools used to manage critical business operations.

These vulnerabilities exist in various SAP products due to memory corruption, missing authentication, credential disclosure, improper access control, XML external entity (XXE) vulnerabilities, insecure deserialization, injection flaws, security misconfigurations, and missing authorization checks. A remote attacker could exploit these vulnerabilities by sending specially crafted requests to the targeted systems.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code, elevate privileges, obtain sensitive information, bypass security restrictions, cause memory corruption, cause denial of service (DoS) conditions, gain unauthorized access, manipulate application data, and perform server-side request forgery (SSRF) on the targeted system.

Solution

Apply appropriate fixes as mentioned in SAP Security Advisory:

https://support.sap.com/en/my-support/knowledge-base/security-notes-news/september-2026.html

Vendor Information

SAP
https://support.sap.com/en/my-support/knowledge-base/security-notes-news/september-2026.html

References

SAP
https://support.sap.com/en/my-support/knowledge-base/security-notes-news/september-2026.html

CVE Name

CVE-2026-44756
CVE-2026-58240
CVE-2026-76969
CVE-2026-66768
CVE-2026-58243
CVE-2026-76958
CVE-2026-76967
CVE-2026-66767
CVE-2026-2332
CVE-2026-76968
CVE-2026-44766
CVE-2026-76971
CVE-2026-34477
CVE-2026-76977
CVE-2026-76960
CVE-2026-76961
CVE-2026-76959
CVE-2026-76962
CVE-2026-76963
CVE-2026-58234