SAP Security Patch Day – September 2026

HotNews

Let’s start with HotNews, the highest-priority category. This month, we have 5 notes to consider in this category.

3747649 – Memory Corruption vulnerability in SAP Extended Passport (EPP) Processing

This vulnerability affects ABAP, Java and Web Dispatcher systems and require an immediate update, especially for systems that are public network facing. The SAP Extended Passport (EPP) is a rather technical data structure, that can be sent from clients to servers to analyze and correlate calls to components. Details for this vulnerability are not given but the fact that an unauthenticated hacker can exploit this – including scope change – pushes the criticality to the highest level. There is a workaround for Web Dispatcher and HTTPS only. See FAQ note 3776034 for more information.

3771065 – Improper Authorization in SAP Commerce Cloud (Data Hub Adapter)

This HotNews note was released in-between August and September but we highlight it nevertheless. This security issue affects SAP Commerce Cloud with Data Hub Adapter deployed. An unauthenticated hacker can exploit this vulnerability for Remote Code Execution (RCE) which means a full compromise of the system involved. Make sure to update the system as soon as possible. The attack surface can be reduced by restricting access to the data hub adapter endpoint. See FAQ note 3775386 that gives a detailed description of several scenarios.

3759472 – Missing Authentication check in SAP NetWeaver (Message Server)

The message server is a central component in an ABAP-based SAP system and acts as a communication channel between application instances. It also performs load balancing of logons and provides information on the running instances for SAP Web Dispatchers for example. It is essential that only allowed application instances can register on the message server. This vulnerability allows unauthenticated registration with high impact on the affected system. This requires a kernel update and there is no workaround. 

Note: although Java-based systems also have a message server component, only ABAP-based systems are relevant with kernel version 9.16. See FAQ note 3776167 for more information.

3798315 – Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)

CAP applications that are multitenant, make use of the@sap/cds-mtxs NPM library and have extensibility services configured, can be vulnerable. This vulnerability can lead to exposure of credentials and successive impact on the system. Check the version dependencies and potential workarounds in the note. See FAQ note 3802171 for additional information.

3781729 – Improper Access Control in SAP NetWeaver (SAP GUI for Java)

This time, the vulnerability lies on the client-side. SAP GUI for Java does not correctly enforce the trust level policy for certain functions when used by the affected versions. Make sure to update the SAP GUI for Java for those clients that make use of it.

 

High-Priority Notes

Next up is the High Priority category, with 5 notes to consider this month. See the highlights below.

3792978 – XML External Entity (XXE) Vulnerability in SAP Integration Suite

XML payloads may be used to gain file access from the server and further expose its contents. SAP Integration Suite may be a cloud PaaS solution, the fix here is to upgrade the iFlow packages and re-deploy.

3784138 – Insecure Deserialization in SAP NetWeaver Business Client

Again a security issue that is located at the client-side. If the NetWeaver Business Client is used, make sure to update to the patch levels mentioned in the note.

3791068 – CLRF Injection vulnerability due to use of Jetty components in SAP Commerce Cloud (Search And Navigation)

A common vulnerability scenario for SAP Commerce Cloud deployments is when vulnerable 3rd party components are used. In this case, it concerns a security issue in the Jetty HTTP server. Make sure to check if the vulnerability applies. If so, build and re-deploy accordingly. See also note 3787345 for a similar mitigation process.

Medium- and Low-Priority Notes

As we see in almost every patch cycle, the majority of security notes fall into the Medium or Low category. This time, there are ten and one respectively. These issues can typically be resolved by simply applying the supplied patches. We highlight additional key findings below, and for a full breakdown, please scroll to the end of this post.

3786489 – Server-Side Request Forgery in SAP Manufacturing Integration and Intelligence

This concerns a SSRF vulnerability on SAP Manufacturing Integration and Intelligence. Instead of simply applying a patch, there is a number of steps to follow to mitigate the issue. See the note for this description.

3750721 – Information Disclosure vulnerability in SAP Web Dispatcher, Internet Communication Manager and SAP Content Server

This security issue concerns the administration functionality of the SAP ICM component which can be exploited for information disclosure. The issue is fixed by applying a kernel patch. A workaround is possible by restricting access to the administration page of the ICM using parameter icm/HTTP/admin_<x>. This is a recommended setting anyway and checked by default for systems using SecurityBridge.