[sap]

October 14, 2026

• SAP patched a CVSS 10.0 OAuth2 SSRF in the Cloud SDK for Python (CVE-2026-89111, fixed in 0.45.2): an attacker who controls the tenant_subdomain parameter in multi-tenant BTP apps can redirect OAuth2 token requests to their own server and exfiltrate client credentials. Workaround is an allowlist of registered tenant subdomains. Also critical: CVE-2026-89110 (NetWeaver Visual Composer broken access control, 9.9) (BleepingComputer). · Vulnerabilities & Exploits

in Three Chained Zero-Days Put Root on a Fully Patched Ivanti VPN

September 21, 2026

• SAP's September patch day carried CVE-2026-44756 ("OVERPASS", CVSS 10.0, memory corruption in Extended Passport processing, found by Onapsis Research Labs) and CVE-2026-58240 ("S4GET", 9.8, missing authentication check in the NetWeaver Message Server) — both remotely exploitable without authentication (CERT-EU). · Vulnerabilities & Exploits

in ShinyHunters Takes Cl0p's Leak Site Hostage

September 10, 2026

• CERT-EU issued a formal advisory on SAP's two criticals — OVERPASS (CVE-2026-44756, CVSS 10.0, memory corruption in kernel Extended Passport processing, reachable unauthenticated from the web, SAP GUI and RFC layers) and S4GET (CVE-2026-58240, 9.8, missing auth in the NetWeaver Message Server) (CERT-EU; earlier coverage). · Exploited in the Wild

in One Exploit Kit, Four Espionage Crews: BlueMoon Turns Chrome's Patch Gap Into a Shared Weapon

August 17, 2026

• SAP Commerce Cloud CVE-2026-58231 (CVSS 10) exploited three days after disclosure. Attacks landed despite a patch and with no prior public PoC, a fast turnaround on a maximum-severity bug (SecurityWeek) (earlier coverage). · Active Exploitation — Developing Threads

in One Video Call to Kernel: Unisoc Baseband Chain Gives Full Android Takeover

August 15, 2026

• SAP Commerce Cloud maximum-severity flaw CVE-2026-58231 (CVSS 10.0, Data Hub Adapter) is now being targeted in attacks, enabling unauthenticated arbitrary code execution (BleepingComputer, The Hacker News). · Vulnerabilities & Exploits

in A Heavy Day for Exploit Research and In-the-Wild N-Days

July 15, 2026

• SAP patched three critical flaws in NetWeaver (CVSS 9.9 ABAP data-tampering bug), Commerce Cloud, and AppRouter, among 16 fixes this month; impacts range from data modification to request-response desync. BleepingComputer, The Hacker News · Vulnerabilities & Exploits

in Record-Breaking Patch Tuesday Ships With Live Active Directory and SharePoint Zero-Days