SAP Security Patch Day: September 2026
Released September 8, 2026 · 18 notes · Source: CVE records on CVE.org (SAP as CNA)
Scheduled for September 8, 2026 (second Tuesday)
- SAP notes
- 18
- Critical
- 4
- High
- 3
- Highest CVSS
- 10.0
- Known exploited
- 0
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Our summary
18 notes with SAP CVEs. 4 Critical and 3 High (priority derived from CVSS, not SAP’s priority). Highest CVSS 10.0.
What to patch first
Ordered by: known exploitation (CISA KEV), then priority (derived from CVSS, not SAP’s priority), then CVSS. A triage aid, not a substitute for your own risk assessment.
Memory Corruption vulnerability in SAP Extended Passport (EPP) Processing
Missing Authentication check in SAP NetWeaver (Message Server)
Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)
Improper Access Control in SAP NetWeaver (SAP GUI for Java)
XML External Entity (XXE) Vulnerability in SAP Integration Suite
Need this month’s notes triaged for your own landscape? SAP security services (digitaldisciple.dev)
All notes
Priority is derived from CVSS, not SAP’s priority: CVSS 9.0 or higher is Critical, 7.0 or higher High, 4.0 or higher Medium, below 4.0 Low. SAP’s own priority is only on SAP for Me (SAP login required).
Coverage: this site is built from SAP’s CVE records, so notes without a CVE, notes with only third-party CVEs (for example Apache or OpenSSL), and updates to earlier notes are not covered. That is about 7% of new notes.
Showing 18 of 18
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3747649 | Memory Corruption vulnerability in SAP Extended Passport (EPP) Processing New | SAP Extended Passport (EPP) Processing | Critical | 10.0 | CVE-2026-44756 |
| 3759472 | Missing Authentication check in SAP NetWeaver (Message Server) New | SAP NetWeaver | Critical | 9.8 | CVE-2026-58240 |
| 3798315 | Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP) New | SAP Cloud Application Programming Model | Critical | 9.4 | CVE-2026-76969 |
| 3781729 | Improper Access Control in SAP NetWeaver (SAP GUI for Java) New | SAP NetWeaver | Critical | 9.0 | CVE-2026-66768 |
| 3792978 | XML External Entity (XXE) Vulnerability in SAP Integration Suite New | SAP Integration Suite | High | 8.5 | CVE-2026-76958 |
| 3784138 | Insecure Deserialization in SAP NetWeaver Business Client New | SAP NetWeaver Business Client | High | 7.8 | CVE-2026-76967 |
| 3757002 | Memory Corruption vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | High | 7.7 | CVE-2026-66767 |
| 3750721 | Information Disclosure vulnerability in SAP Web Dispatcher, Internet Communication Manager and SAP Content Server New | SAP Web Dispatcher, Internet Communication Manager and SAP Content Server | Medium | 6.5 | CVE-2026-76968 |
| 3756450 | SQL Injection vulnerability in SAP S/4HANA (Intercompany Matching and Reconciliation) New | SAP S/4HANA | Medium | 6.5 | CVE-2026-44766 |
| 3786489 | Server-Side Request Forgery in SAP Manufacturing Integration and Intelligence New | SAP Manufacturing Integration and Intelligence | Medium | 6.5 | CVE-2026-76971 |
| 3680888 | Information Disclosure vulnerability in SAP Fiori Launchpad NewPublished outside Patch Day | SAP Fiori Launchpad | Medium | 5.3 | CVE-2026-76974 |
| 3365311 | Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management) New | SAP S/4HANA | Medium | 4.6 | CVE-2026-76959 |
| 3657599 | Missing Authorization check in SAP S/4HANA (Manage Bank Chains app) New | SAP S/4HANA | Medium | 4.3 | CVE-2026-76962 |
| 3772838 | Missing Authorization Check in Application Server ABAP of SAP NetWeaver and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.3 | CVE-2026-76963 |
| 3783189 | Clickjacking vulnerability in SAPUI5(Frame Options Allowlist) New | SAPUI5 | Medium | 4.3 | CVE-2026-76977 |
| 3365276 | Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management) New | SAP S/4HANA | Low | 3.5 | CVE-2026-76960 |
| 3371336 | Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management) New | SAP S/4HANA | Low | 3.5 | CVE-2026-76961 |
| 3736494 | Denial of Service vulnerability in SAP Process Integration (SOAP Adapter) New | SAP Process Integration | Low | 2.2 | CVE-2026-58234 |