SAP Security Patch Day — September 2026

Exploited 0

Confirmed exploited (CISA KEV, ENISA). "Zero-day" means exploitation was known by the patch day — install these first.

None of this release's vulnerabilities is known to be exploited so far.

Critical 4

• Critical 10.0
  CVE-2026-44756 Memory Corruption vulnerability in SAP Extended Passport (EPP) Processing
  EPSS 1.4%
• Critical 9.8
  CVE-2026-58240 Missing Authentication check in SAP NetWeaver (Message Server)
• Critical 9.4
  CVE-2026-76969 Credential disclosure in multitenant applications using SAP Cloud Application Programming Model (CAP)
• Critical 9.0
  CVE-2026-66768 Improper Access Control in SAP NetWeaver (SAP GUI for Java)

All vulnerabilities 17