A patched SAP flaw now sees an exploit or proof-of-concept within one to three days, Onapsis found. In 2021 it took 489.
For SAP vulnerabilities patched in 2025 and 2026, the median gap between SAP's security note and the first verified exploitation or public proof-of-concept code was one to three days, SecurityWeek reported on Friday, citing a…
For SAP vulnerabilities patched in 2025 and 2026, the median gap between SAP's security note and the first verified exploitation or public proof-of-concept code was one to three days, SecurityWeek reported on Friday, citing a study by Onapsis, an SAP security vendor, and threat-intelligence firm Recorded Future. For flaws patched in 2021, the median was 489 days.
SecurityWeek wrote that "Ransomware and extortion groups showing up in SAP-related content grew from 8 in 2023 to 26 in 2025". SAP flaws with confirmed exploitation or public proof-of-concept code doubled from 9 to 18 between end-2023 and mid-2026.
The study drew on 1.2 million-plus threat-intelligence events; underground listings for SAP access ran from $500 to $30,000.
SAP publishes security notes on Patch Day, the second Tuesday monthly, and is not quoted in the report. Onapsis sells SAP security software and has an interest in the findings.
Our reading: with a median of one to three days, a system that waits for the next monthly maintenance window can sit unpatched after an exploit has appeared. The question the numbers raise is whether affected systems can be patched outside that window.
Sources
Our file on SAP
- 13 Nov
IT leaders are listing SAP's ERP among software they may replace, CIO reported. Gartner says most won't make the switch for years.
- 13 Nov
Trek says SAP online store fixes now take a day, not one to two weeks. Developers still approve every AI change.
- 13 Nov
SAP now shows emissions for selected cloud products, based on its servers. It still calls its spend-based estimate the reporting reference.
- 12 Nov
SAP is building seven AI agent families to help upgrade customer code. Its ABAP chief said ABAP changes are usually not undone.
- 12 Nov
SAP says Joule AI, used by 110,000 staff, brought 20% gains. Bloomberg reported SAP has not shown how it measured them.
For your next steering committee
- 1Ask when systems of this kind in your landscape were last patched, and who confirms it.
- 2Ask which finance and ERP accounts can be reached from outside, and how each sign-in is protected.
- 3Ask how long a restore took the last time it was tested.
Issue 01 of the ERP LEADERS brief puts a timeline, the three-number review and six questions on one page. Read issue 01
Welcome back. · Issue 01
