Two CVSS 10.0 Vulnerabilities Demand Immediate Action
| HotNews (≥9.0) | High (7.0–8.9) | Medium (4.0–6.9) | Low (<4.0) | Informational |
|---|---|---|---|---|
| 7 | 8 | 15 | 2 | 1 |
| 33 SAP Security Notes (19 new / 14 updated) | 32 Matching GitHub Security Advisories | 2 Notes scoring a full CVSS 10.0 | 4 Notes touching SAP Commerce Cloud |
Table of Contents
1. Executive Summary
2. Key Takeaways
3. Critical Priority Notes
4. SAP Commerce Cloud: A Concentrated Risk Cluster
5. High-Priority Notes (Condensed)
6. Medium & Lower-Priority Notes (Condensed)
7. Software Supply Chain Watch
8. Defender's Perspective: What This Patch Day Tells Us
9. Final Recommendations
Executive Summary
SAP released 19 new Security Notes and updated 14 previously issued ones for the September 2026 Patch Day — 33 notes in total, alongside 32 matching GitHub Security Advisories covering the open-source components SAP ships inside its products. Seven of the 33 notes carry HotNews severity (CVSS 9.0 or above), and two of those seven score a full 10.0 — the maximum possible.
What sets this cycle apart isn't only the count. The two perfect-10 notes sit in genuinely different places in the stack: one is a pre-authentication memory-corruption flaw in the request-processing path shared by essentially every NetWeaver AS ABAP and Java kernel and by SAP Web Dispatcher 9.16; the other is an unauthenticated remote-code-execution path in SAP Commerce Cloud's Data Hub Adapter. Add a pre-auth trust bypass in the Message Server — the component every application server instance in a cluster implicitly trusts — and three notes this month reach “full compromise” territory without a single valid credential. That is an unusually concentrated cluster of unauthenticated, network-reachable, maximum-impact issues for a single Patch Day.
Two secondary stories are worth tracking closely alongside the headline notes. SAP Commerce Cloud shows up in four separate notes this cycle, spanning authorization, Spring Security configuration, Jetty, and Log4j. And the CAP/npm ecosystem inside SAP Business Technology Platform continues to be an active target: a new credential-disclosure CVE lands in the same cycle as SAP's own guidance on a live open-source supply-chain compromise affecting CAP tooling.
Key Takeaways
- If you run any SAP NetWeaver AS ABAP or Java kernel, or SAP Web Dispatcher 9.16, patch Note 3747649 now. It's unauthenticated, CVSS 10.0, and sits in the core request-processing path almost every SAP system relies on.
- Message Server operators — effectively every distributed ABAP/Java landscape — need to patch Note 3759472 without delay. There is no workaround, and successful exploitation lets an unauthenticated attacker register a rogue node as a trusted cluster member.
- SAP Commerce Cloud customers face a concentrated risk cluster this cycle: four notes, two of them CVSS ≥ 9.5. Treat Commerce Cloud as its own accelerated patch track this month, not a line item in the general queue.
- Teams running multitenant CAP applications on BTP should update @sap/cds-mtxs (Note 3798315) immediately, and separately audit their npm dependency tree against Note 3747787's open-source supply-chain warning — two unrelated but compounding risks in the same ecosystem this month.
- SAP GUI for Java users are exposed to a trust-bypass issue (Note 3781729) that can lead to arbitrary command execution on the client machine. Patch the endpoint software, not only the backend.
- Most remaining notes are authorization-check gaps and CSRF issues concentrated in S/4HANA Finance and master-data apps. Individually low severity, but exactly the kind of gap that turns a stolen low-privilege account into something more — don't let these sit indefinitely.
Critical Priority Notes
Five notes this month combine unauthenticated or near-unauthenticated reachability with the highest possible business impact. Each is analyzed in full below.
Note 3747649 — Memory Corruption in SAP Extended Passport (EPP) Processing
| SEVERITY | CVSS | CVE | COMPONENT |
|---|---|---|---|
| HOTNEWS | 10.0 | CVE-2026-44756 | BC-CST-DP |
How widely this is used
The Extended Passport is SAP's internal request-tracing header, carried on essentially every RFC and HTTP request that flows between NetWeaver components. It isn't a specific transaction or module — it's baked into the core dispatcher path of the kernel itself. That means the affected surface is every SAP NetWeaver AS ABAP and Java kernel below the patched level, plus standalone and embedded SAP Web Dispatcher version 9.16 specifically (other Web Dispatcher versions, and the Web Dispatcher bundled with SAP HANA Extended Application Services, are not affected).
Nature of the vulnerability
A missing boundary check during deserialization of EPP data means an externally supplied length field is trusted without validation, producing a classic memory-safety violation — the note's own terminology spans buffer overflow, heap overflow, and dangling-pointer conditions. Critically, the flawed condition can be triggered before authentication takes place.
Attack scenario
No credentials are required — only network reachability to a vulnerable kernel or Web Dispatcher 9.16 instance. An attacker sends a network request containing a malformed EPP header; depending on exploitation, the result ranges from an abnormal process termination to arbitrary code execution under the service account.
Business impact
Because EPP processing sits in the shared request path of virtually every NetWeaver-based system — S/4HANA, ECC, BW, PI/PO, Enterprise Portal, and anything else running on that kernel — a working exploit could crash or hijack the front-end work process of any reachable SAP system, pre-authentication. This is about as close to a landscape-wide, wormable condition as SAP infrastructure gets.
Mitigation and recommendations
Apply the kernel correction immediately — via the dw.sar hotfix or the full SP-stack kernel (SAPEXE.SAR / SAPEXEDB.SAR) — and patch standalone or embedded Web Dispatcher using SAPWEBDISP.SAR if you run version 9.16. A workaround exists only for HTTP traffic passing through SAP Web Dispatcher (see the referenced companion note); it is not a substitute for the kernel patch on ABAP or Java stacks. Check every NetWeaver-based system in the landscape against current kernel patch levels — including sandbox, dev, and QA systems that teams often deprioritize but that are equally reachable to an attacker already inside the network.
Note 3759472 — Missing Authentication Check in SAP NetWeaver Message Server
| SEVERITY | CVSS | CVE | COMPONENT |
|---|---|---|---|
| HOTNEWS | 9.8 | CVE-2026-58240 | BC-CST-MS |
How widely this is used
The Message Server is the switchboard of an ABAP or Java cluster: every application server instance registers with it, and it brokers logon groups, load balancing, and inter-instance communication. Any landscape running more than a single application server instance — which is most production systems — depends on it.
Nature of the vulnerability
The Message Server does not sufficiently verify that a component registering as an internal application server instance is legitimate. A reachable rogue server can register itself as though it were a trusted cluster member.
Attack scenario
Only network access to the Message Server's internal registration port is required — no credentials. An attacker stands up a rogue server, registers it into the cluster's trust boundary, and can then perform unauthorized actions within the application environment from that position.
Business impact
An attacker who registers a rogue node inherits a degree of trust normally reserved for legitimate application servers, which can be used to interfere with load-balancing and logon-group logic, impersonate a cluster member, or pivot into internal inter-instance communication. Because it needs zero credentials and SAP has published no interim mitigation, this is a patch-now item for essentially every distributed landscape.
Mitigation and recommendations
Apply the kernel correction referenced in the note — the latest kernel patch level (delivered via dw.sar hotfix or full SAPEXE.SAR / SAPEXEDB.SAR) contains it. There is no workaround. As an interim risk-reduction step only, restrict network reachability of the Message Server's internal registration port to trusted application-server hosts — but treat this as a stopgap, not a fix.
Note 3771065 (updated) — Improper Authorization in SAP Commerce Cloud (Data Hub Adapter)
| SEVERITY | CVSS | CVE | COMPONENT |
|---|---|---|---|
| HOTNEWS | 10.0 | CVE-2026-58231 | CEC-SCC-PLA-PL |
How widely this is used
Affects SAP Commerce Cloud (Hybris) instances with the Data Hub Adapter extension enabled — a common integration path for product and order data. This note was first published in August and has now been re-released with updated “Reason and Prerequisites” text as part of the September cycle.
Nature of the vulnerability
An unauthenticated attacker can abuse a default authentication client and submit crafted input to functions that lack sufficient validation, enabling arbitrary code execution through ImpEx injection. In a standard, unmodified Commerce Cloud configuration, the datahubadapter webapp is deployed on the backoffice aspect, which is not intended for public exposure — so unmodified environments are not exposed to this by default. Real risk hinges on whether that endpoint has been made reachable through custom deployment or routing decisions.
Attack scenario
No authentication is required. If the /datahubadapter/import/** path is reachable, an attacker can submit crafted requests that the Data Hub Adapter processes as trusted integration traffic, resulting in code execution on the Commerce Cloud instance.
Business impact
Where reachable, this is full remote code execution — complete compromise of the Commerce Cloud instance, including customer, order, and payment data, and the backoffice administration layer. The September update specifically refined the guidance on what makes an instance actually exposed, so an assessment made back in August is worth revisiting even if you concluded your environment wasn't reachable at the time.
Mitigation and recommendations
Apply Commerce Cloud patch release 2211-jdk21.17 or 2211.55 (or later), then rebuild and redeploy. As a temporary workaround, restrict the /datahubadapter/import/** path with an IP filter set to only the DataHub server's known egress addresses — but note this does not stop an attacker who can spoof that address range or who already has access to the DataHub server itself.
Note 3798315 — Credential Disclosure in Multitenant CAP Applications
| SEVERITY | CVSS | CVE | COMPONENT |
|---|---|---|---|
| HOTNEWS | 9.4 | CVE-2026-76969 | BC-XS-CDX-SEC |
How widely this is used
Applies to multitenant applications built on SAP's Cloud Application Programming Model (Node.js or the Java sidecar) that use the @sap/cds-mtxs library with extensibility services configured — a common pattern for BTP-hosted SaaS-style applications that let each tenant extend their own data model.
Nature of the vulnerability
The library does not perform sufficient checks on certain extensibility functionality, allowing an unauthenticated attacker to obtain sensitive credentials tied to tenant extension operations.
Attack scenario
No authentication is required. An attacker sends crafted requests to the affected endpoints to obtain credentials, then uses them to replace or delete tenant-level data — a direct integrity and availability hit on top of the initial disclosure.
Business impact
For CAP applications with multi-tenant extensibility enabled, this is a path to tenant data destruction or replacement, plus exposure of credential material. It compounds the separate open-source supply-chain issue affecting CAP tooling this month (see Software Supply Chain Watch) — teams running CAP on BTP have two independent reasons to audit their npm dependency tree right now.
Mitigation and recommendations
Update @sap/cds-mtxs to a patched version — 4.0.3+, 3.9.7+, 2.7.7+, or 1.18.4+ depending on your major line — and verify with npm ls before redeploying. SAP has centrally blocked the affected endpoints for all Cloud Foundry customers as an emergency measure, but this only stops new tenant-extension changes via cds pull/push or the REST APIs; existing extensions keep running unaffected, so it is not a substitute for patching. Customers outside Cloud Foundry must apply the documented workaround referenced in the companion FAQ note.
Note 3781729 — Improper Access Control in SAP GUI for Java
| SEVERITY | CVSS | CVE | COMPONENT |
|---|---|---|---|
| HOTNEWS | 9.0 | CVE-2026-66768 | BC-FES-JAV |
How widely this is used
SAP GUI for Java is the cross-platform desktop client used wherever Windows-only SAP GUI isn't an option — Basis teams, developers, and consultants on macOS or Linux are the typical population.
Nature of the vulnerability
SAP GUI for Java does not correctly enforce trust-level policy for certain functions invoked from a connected backend system. Functionality meant to be restricted to trusted systems can be triggered by an untrusted one.
Attack scenario
A low-privileged attacker needs the ability to place a payload within a transaction opened via SAP GUI for Java against an untrusted ABAP backend — or to convince a victim to open one. The backend doesn't need to be part of your trusted production landscape; it can be any ABAP system the client happens to connect to, including a compromised sandbox, a demo instance, or a system reached through a jump host. Once triggered, the payload executes arbitrary commands on the victim's machine.
Business impact
This is an endpoint-compromise vector, not a backend one. SAP GUI for Java runs on the workstations of consultants, developers, and administrators — machines that typically hold cached credentials, SSO tokens, and access paths into multiple backend systems. It's the same class of “trust the wrong data source” risk that made the SAP GUI/GuiXT issue worth flagging on its own back in March.
Mitigation and recommendations
Apply the SAP GUI for Java patches referenced in the note; there is no workaround. Treat this as an endpoint-security item: review which ABAP systems your GUI-for-Java users are expected to connect to, and don't assume a thin client is exempt from patch governance.
SAP Commerce Cloud: A Concentrated Risk Cluster
Four separate notes touch SAP Commerce Cloud (Hybris) this cycle — two of them already covered above. Taken together, they justify pulling this product line into its own accelerated patch track this month.
| Note 3733064 — Missing Authentication Check in SAP Commerce Cloud Configuration CVSS 9.6 An overly permissive Spring Security configuration, combined with incorrect rule ordering, allows an unauthenticated user to reach sensitive internal functionality and inject malicious input that executes as server-side code. First published in May 2026 and re-released this cycle with textual clarifications — if your landscape is still unpatched since May, this is effectively a second HotNews note at CVSS 9.6. Fixed in Commerce Cloud patch releases 2205.49, 2211.51, and 2211-jdk21.10. |
| Note 3791068 — HTTP Request Smuggling via Jetty (Search and Navigation) CVSS 7.4 SAP Commerce Cloud's Search and Navigation component bundles a version of Eclipse Jetty vulnerable to a chunked-transfer-encoding parsing flaw: a carriage-return/line-feed sequence inside a quoted chunk extension is mishandled, letting an attacker smuggle a second HTTP request past a front-end reverse proxy. Exploitability depends on the instance sitting behind a proxy that forwards chunked requests — SAP's own guidance notes that environments following the documented requirement to keep Solr off the public internet are not reachable by this path. Fixed by upgrading Jetty to jetty-http 12.1.7 / 12.0.33 / 11.0.29 / 10.0.28 / 9.4.60 or later, delivered through Commerce Cloud patch release 2211-jdk21.18. |
| Note 3787345 — Log4j TLS Hostname Verification Bypass (Search and Navigation) CVSS 5.9 The bundled Apache Log4j library doesn't enforce hostname verification for TLS connections, which is relevant if you've configured an SMTP, Socket, or Syslog appender with TLS. A network-positioned attacker could intercept or tamper with log traffic in transit. Fixed via upgraded Log4j delivered in Commerce Cloud patch releases 2211-jdk21.13 and 2211.53. |
Every one of these four fixes ships as part of a Commerce Cloud patch or update release that requires a full rebuild and redeploy — not a single kernel patch applied in isolation. If Commerce Cloud is anywhere in your landscape, plan the build pipeline time accordingly rather than treating this as a same-day change.
| Also HotNews this cycle — Note 3727078: Directory Traversal in AS Java's Web Container CVSS 9.0 A malicious HTTP logon request can manipulate file-inclusion parameters in AS Java's Web Container, enabling path traversal and processing of the included file (CVE-2026-40128, component BC-JAS-WEB). Unauthenticated, but SAP notes the attack requires conditions outside the attacker's control (CVSS access complexity is high), which lowers practical likelihood relative to the two perfect-10 notes above. This note was first published in July 2026 and re-released this cycle purely to extend the corrected support-package range for ENGINEAPI 7.50 from SP020 through SP028 — if you're on ENGINEAPI 7.50, re-check your patch level falls within the newly extended range even if you addressed this note over the summer. |
High-Priority Notes (Condensed)
Eight more notes carry CVSS 7.0–8.9. None require zero-click, unauthenticated reach at internet scale the way the notes above do, but each has a clear path to serious impact once an attacker has some form of access.
Development and administration tooling
| Note / CVE | CVSS | What it means |
|---|---|---|
| 3772411 CVE-2026-58243 | 8.8 | SQL Console in ABAP Development Tools allows host expressions that bypass its intended scope, letting a low-privileged user run unauthorized database reads and writes. Interim mitigation: strip authorization objects S_TABU_NAM and S_TABU_DIS from all users until patched. |
| 3773304 CVE-2026-58233 | 7.6 | Insecure deserialization in a third-party library used by the ctsattach command-line tool enables remote code execution when a crafted MTA archive is processed. SAP's fix is discontinuing the tool entirely — the action here is deletion, not patching: remove every installed copy. |
Integration and session-layer risk
| Note / CVE | CVSS | What it means |
|---|---|---|
| 3792978 CVE-2026-76958 | 8.5 | XXE vulnerability in SAP Integration Suite's Trading Partner Management, active when Custom Rules/Search Attributes are enabled or inbound payloads use the cXML type system — a low-privileged attacker can read local file contents off the server. Fix: upgrade the TPM iFlow package to v2.10.0+ (or the B2B Integration Factory variant to v1.11.0+) and redeploy. |
| 3757002 CVE-2026-66767 | 7.7 | A decompression flaw in AS ABAP's DIAG/RFC handling can let an unauthenticated attacker hijack another user's session under narrow timing conditions when a crafted packet coincides with a legitimately buffered request. Low practical likelihood, high impact if it lands — patch via kernel update. |
| 3786038 CVE-2026-58230 +8 more | 7.0 | SAP Approuter bundles nine chained CVEs this cycle — information disclosure, certificate-validation bypass, missing authorization on WebSocket flows, session-integrity bypass, CSRF, and multiple denial-of-service conditions. Most carry non-default prerequisites individually, but Approuter sits in front of nearly every BTP application. Fix: upgrade @sap/approuter to 23.0.0+, and explicitly set STATE_PARAMETER_SECRET to true as an interim CSRF mitigation. |
Application and client layer
| Note / CVE | CVSS | What it means |
|---|---|---|
| 3784138 CVE-2026-76967 | 7.8 | SAP NetWeaver Business Client insecurely deserializes locally stored data at startup. Requires an attacker with local access to the client PC to tamper with that data first — an endpoint-integrity issue more than a remote one, but the payoff is code execution in the user's context. |
| 3732471 CVE-2026-34259 | 8.2 | OS command injection in SAP Forecasting & Replenishment, reachable by an authenticated user holding administrative authorizations. “Authenticated” doesn't mean low value here — the required role is already privileged, and the payoff is full OS-level compromise. |
Practical takeaway: this group is less about internet exposure and more about what a low-privilege foothold or a compromised endpoint can escalate into. Prioritize the SQL Console and ctsattach items if your Basis/development team uses ABAP Developer Tools day to day.
Medium & Lower-Priority Notes (Condensed)
Fifteen Medium and two Low-severity notes round out the cycle. Individually modest, but several form recognizable clusters worth handling together.
1. Authorization and CSRF debt in S/4HANA Finance and master data
| Note / CVE | CVSS | What it means |
|---|---|---|
| 3371336 / 3365311 / 3365276 | 4.3 each | Three companion CSRF notes in S/4HANA Finance (Advanced Payment Management): state-changing function imports were consumed via GET instead of POST. SAP explicitly cross-references all three — apply together, not individually. |
| 3657599 CVE-2026-76962 | 4.3 | Missing authorization check in the Manage Bank Chains app lets a low-privileged user delete entries they shouldn't reach. |
| 3772838 CVE-2026-76963 | 4.3 | Missing authorization check in AS ABAP's internationalization functionality exposes system configuration details to authenticated low-privilege users. |
| 3530544 (updated) CVE-2025-42899 | 4.3 | Missing authorization check in S4CORE's Manage Journal Entries app. |
2. Injection and data exposure
| Note / CVE | CVSS | What it means |
|---|---|---|
| 3756450 CVE-2026-44766 | 6.5 | SQL injection in Intercompany Matching and Reconciliation via unsanitized filter input. Interim mitigation: restrict business-user access to transaction codes ICARM and ICADR; use the standard job templates instead. |
| 3786489 CVE-2026-76971 | 6.5 | SSRF in Manufacturing Integration and Intelligence via the XMLProxy endpoint. SAP's fix note is largely configuration hardening — restrict MII admin roles and validate SourceURL parameters. |
| 3750721 CVE-2026-76968 | 6.5 | Web Dispatcher, ICM, and SAP Content Server can expose system-state details through admin functionality when the public admin interface is left enabled. Disable ALLOWPUB on the relevant ICM parameters as an interim step. |
| 3680767 (updated) CVE-2026-34264 | 6.5 | SAP HCM for S/4HANA returns authorization-check messages specific enough for a low-privilege user to enumerate data beyond their scope. |
3. Client-facing web risk
| Note / CVE | CVSS | What it means |
|---|---|---|
| 3783189 CVE-2026-76977 | 4.3 | SAPUI5's frame-options allowlist doesn't strictly match hostnames, enabling clickjacking against apps configured with a host-based allowlist. Update UI5 to the patched level for your support package. |
| 3692004 (updated) CVE-2026-34257 | 6.1 | Open redirect in AS ABAP ITS; customers using rfid device URLs must also add the allowed URL to the UCON allowlist (or HTTP_WHITELIST on older releases). |
| 3682699 (updated) CVE-2026-24315 | 4.2 | Path traversal in the Fiori Launchpad enables credential-stealing crafted URLs. Fixed across every supported UI5 line; UI5 1.146 and above is secure by default, no action needed there. |
4. Third-party library hygiene
| Note / CVE | CVSS | What it means |
|---|---|---|
| 3726899 (updated) CVE-2025-68161 | 3.3 | Same Log4j Socket Appender hostname-verification gap as the Commerce Cloud finding above, here in AS Java's UME component. A follow-up advisory (CVE-2026-34477) shows the original fix for this class of bug was incomplete for the verifyHostName configuration attribute — worth re-checking your Log4j version across both AS Java and Commerce Cloud rather than assuming one patch covers both paths. |
| 3540688 (updated) CVE-2025-42947 | 5.5 | Code injection in the FICA ODN framework, reachable only by a high-privileged user. Only relevant if you use the FICA ODN solution. |
5. Availability only
| Note / CVE | CVSS | What it means |
|---|---|---|
| 3736494 CVE-2026-58234 | 2.2 | Deeply nested XML entities sent to the Process Integration SOAP Adapter by a privileged user can raise processor load. Fixed by disabling DOCTYPE processing. |
Practical takeaway: none of these justify an emergency change window on their own, but the CSRF and authorization clusters are exactly what attackers use once they already hold any valid low-privilege session — fold them into your regular patch cycle rather than deferring indefinitely.
Software Supply Chain Watch
One note this cycle isn't a traditional vulnerability at all — it's an active-incident notice, and it deserves a different kind of response than a patch schedule.
| Note 3747787 — Malicious Open-Source Packages in SAP CAP and MTA Build Tool INFORMATIONAL Between late April and mid-May 2026, malicious versions of several npm packages used by SAP's Cloud Application Programming Model tooling were published to the public npm registry: specific versions of @cap-js/openapi, @cap-js/sqlite, @cap-js/postgres, @cap-js/db-service, and the mbt build tool. The malicious versions were designed to exfiltrate credentials and attempt to propagate into downstream repositories and adjacent packages when installed. SAP has since removed the affected versions from the npm registry and published patched releases for each package. |
If any of the affected versions ever touched a build pipeline, CI runner, or developer machine, treat it as a credential-compromise incident rather than a missing patch:
- Clean caches — remove the malicious versions from CI/CD package caches and any internal registry mirrors so they can't be reinstalled from a stale cache.
- Isolate affected systems — disconnect any developer machine or CI runner that installed an affected version, and treat re-imaging as the safer option over a simple uninstall.
- Rotate every reachable secret — SSH keys, GitHub/npm tokens, cloud credentials, and any other secret an infected system could have accessed should be considered compromised, not just credentials the package itself touched.
- Audit for indicators of compromise — unexpected GitHub repositories, unfamiliar workflow branches or Actions files, and IDE configuration changes committed to unrelated repositories are the patterns SAP flags in the note.
- Pin exact versions going forward, and use --ignore-scripts when updating to the patched releases to prevent any lingering install hooks from executing.
This is the second consecutive cycle where the CAP/npm ecosystem has needed attention — pair this audit with the @sap/cds-mtxs update from Note 3798315 above rather than treating them as unrelated items on two different tickets.
Defender's Perspective: What This Patch Day Tells Us
Core infrastructure is back in the crosshairs.
Two CVSS 10.0 notes and a no-workaround pre-auth Message Server flaw in the same cycle is a meaningful signal. For a stretch of recent Patch Days, the highest-severity findings tended to sit in specific applications or modules; this month, two of the three most severe issues live in components — the kernel's request path and the Message Server — that every landscape runs regardless of which SAP products sit on top. Kernel and Web Dispatcher patch cadence deserves the same urgency as application-layer patching, not a slower, “infrastructure team's problem” cycle.
SAP Commerce Cloud is having a rough season.
Four notes in one cycle, spanning authorization, Spring Security configuration, a third-party HTTP server, and a third-party logging library, is a lot for a single product line. If Commerce Cloud runs anywhere in your estate, this alone justifies standing up a dedicated, accelerated patch cycle for it this month rather than folding it into the general queue.
The open-source layer inside SAP is a live, ongoing attack surface.
Between the @sap/cds-mtxs credential-disclosure CVE, the Jetty and Log4j findings in Commerce Cloud, and the active npm supply-chain incident in CAP tooling, at least five items this month trace back to open-source dependencies rather than SAP's own code. This isn't a one-off — it's a pattern that argues for treating dependency inventory and version pinning as a standing part of SAP security operations, not a reactive step taken only after an advisory lands.
Authorization and CSRF debt keeps recurring.
As in prior cycles, a large share of the Medium-severity notes are missing-authorization or CSRF gaps in ABAP applications. They're not “internet worm” problems, but they're exactly what an attacker uses after obtaining any low-privilege foothold — a phished account, a shared technical user, a compromised endpoint. Treating this cluster as low priority because no single note scores above a 6.5 misses the point: these are the moves that come next.
Final Recommendations
Patch prioritization
| Priority | Notes | Action |
|---|---|---|
| P0 — Immediate | 3747649, 3759472, 3771065 | Unauthenticated, CVSS ≥ 9.4, direct path to full compromise. Patch within 24–48 hours; apply the documented interim workarounds only as a bridge, never as the destination. |
| P1 — This week | 3798315, 3781729, 3733064, 3727078 | Update @sap/cds-mtxs, patch SAP GUI for Java clients, and re-verify the two re-released HotNews notes if you haven't already remediated them since May/July. |
| P2 — 2–4 weeks | 3792978, 3784138, 3757002, 3772411, 3732471, 3773304, 3786038, 3791068, 3787345 | Remaining High-severity notes, including the Commerce Cloud Jetty/Log4j fixes bundled into the rebuild you're already planning for the P0 Data Hub Adapter fix. |
| P3 — Regular maintenance | All remaining Medium and Low notes | Authorization/CSRF cluster, information-disclosure notes, clickjacking, path traversal, Log4j hostname fixes, and the SOAP Adapter DoS. Fold into your standard cycle — don't defer indefinitely. |
| Special track | 3747787 | Not a patch — an incident-response task. Run the npm supply-chain audit and secret rotation in parallel with the schedule above, starting immediately if CAP/MTA tooling is in use. |
Defense-in-depth beyond patching
- Reduce exposure — keep the Message Server's internal registration port and Web Dispatcher/ICM admin interfaces off untrusted networks; restrict the Data Hub Adapter import path to known DataHub egress IPs; remove every copy of ctsattach rather than trying to patch it.
- Harden identities — rotate any secret reachable from a system that touched the compromised npm package versions; strip S_TABU_NAM/S_TABU_DIS from users who don't need SQL Console access; explicitly set STATE_PARAMETER_SECRET on Approuter.
- Increase detection — alert on new Message Server component registrations, unusual SAP GUI for Java backend connections, and egress traffic associated with the supply-chain indicators of compromise in Note 3747787.
- Validate the outcome — confirm actual kernel patch levels fleet-wide (not just on flagship systems), verify @sap/cds-mtxs version via npm ls post-deployment, and re-test business-critical Commerce Cloud flows after the rebuild-and-redeploy cycle rather than assuming the patch release alone closes the loop.
Severity ratings and CVSS scores reflect SAP's official Security Notes released September 8, 2026. Always validate patch applicability against your own release, support package, and kernel level before implementing.
