{"id":14644,"date":"2026-09-11T09:03:03","date_gmt":"2026-09-11T07:03:03","guid":{"rendered":"https:\/\/www.inprosec.com\/?p=14644"},"modified":"2026-09-11T09:03:03","modified_gmt":"2026-09-11T07:03:03","slug":"sap-security-notes-september-2026","status":"publish","type":"post","link":"https:\/\/www.inprosec.com\/en\/sap-security-notes-september-2026\/","title":{"rendered":"SAP Security Notes, September 2026"},"content":{"rendered":"

Through services such as the SAP Security Assessment, Inprosec helps its clients improve the security levels of their SAP systems.<\/b><\/p>\n\n

September 2026 Notes<\/h2>\n

Monthly Summary and Highlights<\/h3>\n
\n
This month the total number has been 20 notes<\/b> (19 new and 1 update), 11 fewer than in August. This month 4 Hot News<\/b> have been published, the same amount as in the previous period. As for high-criticality notes, there are 5<\/b>, three fewer than in August. Medium and low notes will not be reviewed, so we will provide detail on a total of 9 notes<\/b> (all those with a CVSS of 7 or higher).<\/div>\n
<\/div>\n
We have a total of 20 notes<\/b> for the whole month (19 new and 1 update to notes from previous months).<\/div>\n
<\/div>\n
We will review in detail a total of 9 notes, all of high criticality and Hot News:<\/div>\n
<\/div>\n
    \n
  1. \n
    The highest-criticality note of the month (CVSS <\/b>10.0<\/b><\/span>) is a Hot News and is related to “Memory Corruption vulnerability in SAP Extended Passport (EPP) Processing”<\/b>.<\/div>\n<\/li>\n
  2. \n
    The second note in criticality (CVSS <\/b>9.8<\/b><\/span>) is another Hot News and is related to “Missing Authentication check in SAP NetWeaver (Message Server)”<\/b>.<\/div>\n<\/li>\n
  3. \n
    The third note in criticality (CVSS <\/b>9.4<\/b><\/span>) is another Hot News and is related to “Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)”<\/b>.<\/div>\n<\/li>\n
  4. \n
    The fourth note in criticality (CVSS <\/b>9.0<\/b><\/span>) is the last Hot News of the month and is related to “Improper Access Control in SAP NetWeaver (SAP GUI for Java)”<\/b>.<\/div>\n<\/li>\n
  5. \n
    The fifth note we will review (CVSS <\/b>8.8<\/b><\/span>) is of high criticality (update) and concerns “Privilege Escalation vulnerability in SAP ABAP Developer Tools”<\/b>.<\/div>\n<\/li>\n
  6. \n
    The sixth note we will review (CVSS <\/b>8.5<\/b><\/span>) is of high criticality and concerns “XML External Entity (XXE) Vulnerability in SAP Integration Suite”<\/b>.<\/div>\n<\/li>\n
  7. \n
    The seventh note we will review (CVSS <\/b>7.8<\/b><\/span>) is of high criticality and concerns “Insecure Deserialization in SAP NetWeaver Business Client”<\/b>.<\/div>\n<\/li>\n
  8. \n
    The eighth note we will review (CVSS <\/b>7.7<\/b><\/span>) is of high criticality and concerns “Memory Corruption vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform”<\/b>.<\/div>\n<\/li>\n
  9. \n
    The ninth and last note we will review (CVSS <\/b>7.4<\/b><\/span>) is of high criticality and concerns “CLRF Injection vulnerability due to use of Jetty components in SAP Commerce Cloud (Search And Navigation)”<\/b>.<\/div>\n<\/li>\n<\/ol>\n
    This month the most predominant type has been “Cross-Site Request Forgery (CSRF)”<\/b> (3\/20 on patch day).<\/div>\n
    <\/div>\n
    In the chart we can see the classification of September’s notes, as well as the evolution and classification of previous months (only Sec. Tuesday \/ Patch Day \u2013 by SAP notes):<\/div>\n
    \n
    <\/div>\n<\/div>\n<\/div>\n

    \"\"<\/p>\n

    Full details<\/h2>\n

    The full details of the most relevant notes<\/b> are as follows (in English):<\/p>\n