ANSSI Flags Multiple SAP Product Vulnerabilities
ANSSI advisory details numerous SAP vulnerabilities across NetWeaver, S/4HANA and related products enabling RCE, privilege escalation, and DoS.
Sourcecert.ssi.gouv.fr — open the original
What to check
- Applies to
- The 20 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
France's ANSSI (CERT-FR) issued an advisory summarizing SAP's September 2026 security patch bulletin, covering a broad set of vulnerabilities across many SAP products including ABAP Developer Tools, Commerce Cloud, NetWeaver (multiple components including ABAP Platform, Message Server, GUI for Java, Business Client), S/4HANA (Finance for Advanced Payment Management, Intercompany Matching and Reconciliation), Integration Suite, Manufacturing Integration and Intelligence, Process Integration (SOAP Adapter), SAPUI5, and Web Dispatcher/ICM/Content Server components. Affected version ranges span many SAP_BASIS, KERNEL, and product-specific releases, indicating wide applicability across SAP customer estates running unpatched systems.
The vulnerability classes identified include remote code execution, privilege escalation, remote denial of service, SQL injection, server-side request forgery (SSRF), cross-site request forgery (CSRF), confidentiality breaches, and security policy bypass. No exploitation in the wild is mentioned, and no proof-of-concept or technical exploitation detail is provided in the advisory. ANSSI directs administrators to SAP's official September 2026 security notes bulletin for the specific patches and to apply them according to affected product and version.
Given the number of CVEs and the presence of remote code execution and privilege escalation among the affected components, organizations running SAP NetWeaver, S/4HANA, or related SAP Business Suite products should prioritize patch review and apply the September 2026 SAP Security Notes across all listed products in their estate. This is a routine monthly vendor patch cycle disclosure rather than an active exploitation event.
Mentioned in this report
Source reporting: https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1134
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs