Patch Day: September 2026
Released September 8, 2026 · 23 notes · Source: SAP Security Patch Day page
Scheduled for September 8, 2026 (second Tuesday)
- New
- 20
- Updated
- 3
- Critical
- 4
- High
- 6
- Highest CVSS
- 10.0
- Known exploited
- 0
Our summary
23 notes (20 new, 3 updated). 4 Critical and 6 High. Highest CVSS 10.0.
What to patch first
Ordered by: known exploitation (CISA KEV), then SAP priority, then CVSS. A triage aid, not a substitute for your own risk assessment.
Memory Corruption vulnerability in SAP Extended Passport (EPP) Processing
Missing Authentication check in SAP NetWeaver (Message Server)
Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)
Improper Access Control in SAP NetWeaver (SAP GUI for Java)
Privilege Escalation vulnerability in SAP ABAP Developer Tools
All notes
SAP’s introduction states 19 new notes and 1 updates; SAP’s table lists 23 rows (these can differ, e.g. GitHub advisories or late additions).
SAP’s top priority is labelled “Hot News” in these bulletins up to December 2024 and “Critical” from October 2024 on; both are shown as Critical.
Showing 23 of 23
| Title | CVE(s) | ||||
|---|---|---|---|---|---|
| 3747649 | Memory Corruption vulnerability in SAP Extended Passport (EPP) Processing New | SAP Extended Passport (EPP) Processing | Critical | 10.0 | CVE-2026-44756 |
| 3759472 | Missing Authentication check in SAP NetWeaver (Message Server) New | SAP NetWeaver | Critical | 9.8 | CVE-2026-58240 |
| 3798315 | Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP) New | sap/cds-mtxs | Critical | 9.4 | CVE-2026-76969 |
| 3781729 | Improper Access Control in SAP NetWeaver (SAP GUI for Java) New | SAP NetWeaver | Critical | 9.0 | CVE-2026-66768 |
| 3772411 | Privilege Escalation vulnerability in SAP ABAP Developer Tools Update | SAP ABAP Developer Tools | High | 8.8 | CVE-2026-58243 |
| 3792978 | XML External Entity (XXE) Vulnerability in SAP Integration Suite New | SAP Integration Suite | High | 8.5 | CVE-2026-76958 |
| 3784138 | Insecure Deserialization in SAP NetWeaver Business Client New | SAP NetWeaver Business Client | High | 7.8 | CVE-2026-76967 |
| 3757002 | Memory Corruption vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | High | 7.7 | CVE-2026-66767 |
| 3485073 | Denial of Service (DoS) due to use of third-party component in SAP S/4HANA (Manage Supply Protection) Update | SAP S/4HANA | High | 7.5 | CVE-2026-66766 |
| 3791068 | CLRF Injection vulnerability due to use of Jetty components in SAP Commerce Cloud (Search And Navigation) New | SAP Commerce Cloud | High | 7.4 | CVE-2026-2332 |
| 3750721 | Information Disclosure vulnerability in SAP Web Dispatcher, Internet Communication Manager and SAP Content Server New | SAP Web Dispatcher, Internet Communication Manager and SAP Content Server | Medium | 6.5 | CVE-2026-76968 |
| 3756450 | SQL Injection vulnerability in SAP S/4HANA (Intercompany Matching and Reconciliation) New | SAP S/4HANA | Medium | 6.5 | CVE-2026-44766 |
| 3786489 | Server-Side Request Forgery in SAP Manufacturing Integration and Intelligence New | SAP Manufacturing Integration and Intelligence | Medium | 6.5 | CVE-2026-76971 |
| 3678417 | Multiple vulnerabilities in BSP Applications of SAP Document Management System Update | SAP Document Management System | Medium | 6.1 | CVE-2026-0505, CVE-2026-24323 |
| 3787345 | Security Misconfiguration vulnerability due to use of Apache Log4j in SAP Commerce Cloud (Search and Navigation) New | SAP Commerce Cloud | Medium | 5.9 | CVE-2026-34477 |
| 3680888 | Information Disclosure vulnerability in SAP Fiori Launchpad New | SAP Fiori Launchpad | Medium | 5.3 | CVE-2026-76974 |
| 3365276 | Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management) New | SAP S/4HANA | Medium | 4.3 | CVE-2026-76960 |
| 3365311 | Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management) New | SAP S/4HANA | Medium | 4.3 | CVE-2026-76959 |
| 3371336 | Cross-Site Request Forgery (CSRF) vulnerability in SAP S/4HANA (Finance for Advanced Payment Management) New | SAP S/4HANA | Medium | 4.3 | CVE-2026-76961 |
| 3657599 | Missing Authorization check in SAP S/4HANA (Manage Bank Chains app) New | SAP S/4HANA | Medium | 4.3 | CVE-2026-76962 |
| 3772838 | Missing Authorization Check in Application Server ABAP of SAP NetWeaver and ABAP Platform New | SAP NetWeaver AS ABAP / ABAP Platform | Medium | 4.3 | CVE-2026-76963 |
| 3783189 | Clickjacking vulnerability in SAPUI5(Frame Options Allowlist) New | SAPUI5 | Medium | 4.3 | CVE-2026-76977 |
| 3736494 | Denial of Service vulnerability in SAP Process Integration (SOAP Adapter) New | SAP Process Integration | Low | 2.2 | CVE-2026-58234 |