Attackers could get into SAP systems without a password. SAP fixed it yesterday.
SAP published 19 new Security Notes and one update on 8 September.
Four were rated Critical.
The highest-rated flaw is a memory corruption issue in Extended Passport processing at CVSS 10.0, tracked as CVE-2026-44756. A missing authentication check in the NetWeaver Message Server scored 9.8, tracked as CVE-2026-58240.
Another fix covers credential disclosure in multitenant applications built on the Cloud Application Programming Model at 9.4, tracked as CVE-2026-76969. Improper access control in SAP GUI for Java scored 9.0, tracked as CVE-2026-66768.
SAP rated five more notes High. The highest was an 8.8 privilege escalation in ABAP Developer Tools.
Onapsis, which reviews every Patch Day, wrote, "The new CVSS 10.0 note requires special attention because it can be exploited remotely and without authentication."
Check the Message Server note first. No credentials are needed to reach the flaw, and the Message Server runs on every ABAP system.
Which of your SAP systems will still be unpatched on Friday?
Sources
Our file on SAP
- 5 Nov
SAP says its network handles over $8 trillion of trade a year. Its AI agent post names no customer.
- 5 Nov
SAP says AI agents handle more than 90% of a wholesaler's 100,000 supplier confirmations unaided. Its Takeda figures are forecasts.
- 5 Nov
SAP says Somerset Council moved about 8,500 staff off its 17-year-old payroll system in 13 months, on budget. Nobody named the budget.
- 5 Nov
SAP offered 300 AI agents. Workday's product chief, a former SAP executive, called the autonomous enterprise idea "cold and soulless".
- 4 Nov
SAP won a Dutch military cloud deal of up to ten years. The ministry says it does not end its SAP dependence.
Every story here is open to read. The ERP LEADERS brief goes one step further.
The day in enterprise software, in one email: the stories that matter, the failures with their figures, one case taken apart. Read a sample or sign up for the brief.
Welcome back. · Issue 01
