SAP’s September Security Patch Day brings 19 new security notes, including four Critical vulnerabilities. While several components require attention, two vulnerabilities stand out because they affect core SAP infrastructure and can be reached without authentication.
Two vulnerabilities to prioritize
CVSS 10.0 — SAP Extended Passport Processing
SAP Note 3747649
The most critical issue this month is a memory-corruption vulnerability in SAP Extended Passport (EPP) processing.
An unauthenticated attacker able to reach an affected service can send a specially crafted EPP request and trigger the vulnerability before authentication takes place. Successful exploitation could impact the confidentiality, integrity and availability of the affected SAP system.
The issue affects multiple SAP Kernel and Web Dispatcher releases. A limited workaround is available for HTTP traffic passing through SAP Web Dispatcher, but it does not replace the required kernel update.
CVSS 9.8 — SAP NetWeaver Message Server
SAP Note 3759472
The second major issue affects the SAP NetWeaver Message Server.
Due to insufficient authentication during component registration, an attacker with network access to an affected Message Server could register a rogue application-server component and perform unauthorized actions within the SAP environment.
The vulnerability affects Kernel releases 9.16, 9.18, 9.19 and 9.20, and SAP provides no workaround, making patching the primary remediation.
What security teams should do
Start by identifying systems running the affected SAP Kernel, Web Dispatcher and Message Server versions and determine where those services are reachable from untrusted or broadly accessible network segments.
Prioritize these systems for patching, particularly externally exposed Web Dispatchers and environments where SAP infrastructure ports are accessible beyond tightly controlled administration or application networks.
The September release also contains Critical issues affecting SAP CAP multitenancy and SAP GUI for Java, alongside several High-severity vulnerabilities. These remain important, but the two unauthenticated infrastructure vulnerabilities should lead this month’s remediation effort.
Notable Trends
1 – Concentrated Application-Layer Injection in SAP MII
Six of the thirty-one entries this cycle target SAP Manufacturing Integration and Intelligence, representing nearly 20% of the entire release. The vulnerability cluster—spanning SSRF-driven code injection (3765948), server-side template injection (3758900), directory traversal (3759854), and three distinct missing authorization checks (3758657, 3758910, 3781137)—indicates a systemic deficiency in input sanitization, path validation, and access-control enforcement across the MII 15.4/15.5 codebase. The presence of two Critical-rated code injection vectors (CVSS 9.9 and 9.1) alongside multiple unauthenticated authorization bypasses suggests that MII’s servlet-based architecture and XSL transformation pipeline have not been adequately hardened against modern injection techniques. Organizations running MII in production should treat this as a single, coordinated remediation campaign rather than discrete patch applications, as the shared Support Package patches (XMII 15.4 SP001 PL 000057; XMII 15.5 SP002 PL 000010) address multiple CVEs simultaneously.
2 – Third-Party and Open-Source Component Exposure in Cloud-Delivered Products
Five vulnerabilities in SAP Commerce Cloud and Data Hub (Notes 3771065, 3773203, 3757815, 3778462, 3770868) and one in SAP NetWeaver AS Java (Note 3758318) are directly attributable to embedded open-source libraries: NGINX, Bouncy Castle, Netty, Apache Log4j Core, OpenSSL, and libcurl. This pattern reflects a broader industry trend where SAP’s cloud and on-premise products inherit risk from their dependency ecosystems. The Commerce Cloud entries are particularly notable because remediation requires a full build-and-deploy cycle rather than a simple patch install, introducing operational friction that may delay adoption. The Bouncy Castle timing-attack vector (CVE-2026-5598) and the Netty HTTP/2 DoS (CVE-2026-33871) further illustrate that even “medium” severity third-party issues can compound when layered across multiple components in a single deployment. Organizations should maintain a continuous dependency-scanning pipeline for SAP cloud applications to detect upstream CVEs before they propagate into SAP’s release cycle.
3 – Kernel-Level Memory Safety and Unauthenticated Attack Surface
The ABAP Platform kernel is affected by three distinct memory-safety vulnerabilities: DIAG protocol parsing corruption (3714806, CVSS 9.8), OS command injection (3745182, CVSS 5.5), and dispatcher uninitialized memory disclosure (3756674, CVSS 5.3). All three are exploitable by unauthenticated, remote attackers over the network with low complexity, and none offer a workaround. The breadth of affected kernel versions (7.22 through 9.19) means that virtually every on-premise NetWeaver ABAP system is in scope. The absence of any compensating control or network-level mitigation elevates the urgency: these are not application-layer issues that can be mitigated through WAF rules or authorization hardening, but fundamental memory-safety defects in the runtime that require kernel-level patching. The 9.8-rated DIAG vulnerability, in particular, warrants immediate attention as it represents a potential remote code execution vector against the most critical layer of the SAP stack.
If you need support identifying exposure, validating remediation, or testing your SAP environment, Vicxer can provide tailored SAP cybersecurity services based on your landscape and requirements. For continuous coverage, you can also see a demo of our automated SAP security solution at https://vicxer.com.