[sap]

September 10, 2026

• CERT-EU issued a formal advisory on SAP's two criticals — OVERPASS (CVE-2026-44756, CVSS 10.0, memory corruption in kernel Extended Passport processing, reachable unauthenticated from the web, SAP GUI and RFC layers) and S4GET (CVE-2026-58240, 9.8, missing auth in the NetWeaver Message Server) (CERT-EU; earlier coverage). · Exploited in the Wild

in One Exploit Kit, Four Espionage Crews: BlueMoon Turns Chrome's Patch Gap Into a Shared Weapon

August 17, 2026

• SAP Commerce Cloud CVE-2026-58231 (CVSS 10) exploited three days after disclosure. Attacks landed despite a patch and with no prior public PoC, a fast turnaround on a maximum-severity bug (SecurityWeek) (earlier coverage). · Active Exploitation — Developing Threads

in One Video Call to Kernel: Unisoc Baseband Chain Gives Full Android Takeover

August 15, 2026

• SAP Commerce Cloud maximum-severity flaw CVE-2026-58231 (CVSS 10.0, Data Hub Adapter) is now being targeted in attacks, enabling unauthenticated arbitrary code execution (BleepingComputer, The Hacker News). · Vulnerabilities & Exploits

in A Heavy Day for Exploit Research and In-the-Wild N-Days

July 15, 2026

• SAP patched three critical flaws in NetWeaver (CVSS 9.9 ABAP data-tampering bug), Commerce Cloud, and AppRouter, among 16 fixes this month; impacts range from data modification to request-response desync. BleepingComputer, The Hacker News · Vulnerabilities & Exploits

in Record-Breaking Patch Tuesday Ships With Live Active Directory and SharePoint Zero-Days