SAP Patches Dozens of Flaws Across NetWeaver Stack
SAP released fixes for over 40 vulnerabilities across NetWeaver, Web Dispatcher, Gateway, and Cloud SDK; no in-the-wild exploitation reported.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 40 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
CISA/MS-ISAC advisory 2026-128 summarizes SAP's latest patch release covering a broad set of SAP products including NetWeaver AS ABAP and Java, Web Dispatcher, Gateway, ABAP Developer Tools, S4CRM, BusinessObjects BI, Cloud SDK for Python and JavaScript, and SAP/astonish. The most severe issues are memory corruption and code/OS command injection flaws that could allow an unauthenticated or low-privileged attacker to achieve arbitrary code execution and fully compromise affected systems, with high impact to confidentiality, integrity, and availability. Other notable issues include missing authentication on the SAML2 Service Provider, a JWT signature verification flaw in the Cloud SDK's IASContextProvider enabling tenant/user identity spoofing, a cross-tenant sandbox takeover in SAP/astonish, SSRF, path traversal, XXE, and multiple CSRF and access-control weaknesses spanning NetWeaver components.
No exploitation in the wild has been reported for any of these CVEs at the time of publication. Given SAP NetWeaver's role as a widely deployed, internet-facing ERP platform, the advisory recommends prompt patching after testing, vulnerability scanning, network segmentation (placing internet-facing SAP components in a DMZ), least-privilege configuration, and regular penetration testing. Defenders should prioritize patching the memory corruption, OS command injection, missing authentication, and identity-spoofing issues given their potential for remote code execution or authentication bypass against exposed SAP Gateway, ICM, Web Dispatcher, and Cloud SDK components.
This is a routine, vendor-driven patch cycle rather than an active campaign; the Threat Intelligence section explicitly notes no known exploitation. Organizations running any of the listed SAP Kernel, SAP_BASIS, or Cloud SDK versions should apply SAP's official patches as part of standard monthly patch management.
Mentioned in this report
Detection guidance
SAP NetWeaver Server Process Spawning Shell or LOLBin on Windows
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
SAP ABAP/Java/Web Dispatcher/Gateway server processes spawning command interpreters or download/execution LOLBins, which is typical of OS command injection or RCE exploitation of an exposed SAP service. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SAP NetWeaver Server Process Spawning Shell or LOLBin on Windows
id: b6620602-2d8e-509d-ad18-d1532ef2f763
status: experimental
description: Detects SAP NetWeaver server processes (ABAP dispatcher work process,
Java server node, Web Dispatcher, ICM, Gateway) spawning command interpreters or
common download/execution binaries. This is consistent with OS command injection
or memory-corruption RCE against internet-facing SAP components. Generalises on
the parent/child relation and does not rely on specific CVEs.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \disp+work.exe
- \jstart.exe
- \sapwebdisp.exe
- \gwrd.exe
- \icman.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \certutil.exe
- \bitsadmin.exe
- \whoami.exe
- \regsvr32.exe
- \rundll32.exe
condition: selection
falsepositives:
- SAP administrators running external OS commands defined in transaction SM69 or SM49
- Custom SAP batch jobs that call cmd.exe scripts
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-sap-products-could-allow-for-arbitrary-code-execution_2026-128
SAP NetWeaver Server Process Spawning Shell or Downloader on Linux
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
SAP dispatcher, Java server node, Web Dispatcher, ICM or Gateway processes spawning shells or download/netcat utilities on Linux, indicating possible command injection exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SAP NetWeaver Server Process Spawning Shell or Downloader on Linux
id: 9d876806-487f-5281-918d-28c61611738f
status: experimental
description: Detects SAP NetWeaver server processes on Linux (disp+work, jstart, sapwebdisp,
gwrd, icman) spawning shells or network download/transfer utilities. Consistent
with OS command injection or RCE against exposed SAP services. Legitimate SM69 external
commands can overlap, so tune for known commands.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059.004
logsource:
category: process_creation
product: linux
detection:
selection:
ParentImage|endswith:
- /disp+work
- /jstart
- /sapwebdisp
- /gwrd
- /icman
Image|endswith:
- /sh
- /bash
- /dash
- /curl
- /wget
- /nc
- /ncat
- /python
- /python3
- /perl
condition: selection
falsepositives:
- External OS commands configured in SM69 that intentionally run shell scripts
- SAP housekeeping jobs invoking shell wrappers
level: medium
author: Vorant
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-sap-products-could-allow-for-arbitrary-code-execution_2026-128
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-sap-products-could-allow-for-arbitrary-code-execution_2026-128
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs