Executive Summary
Recent vulnerabilities such as PHP2Shell have exposed growing security risks in SAP BTP applications, highlighting the need for automated vulnerability scanning and threat detection. SAP’s Application Vulnerability Report (AVR) addresses these risks by scanning deployed Cloud Foundry applications for known vulnerabilities using OSV and other security intelligence sources. By integrating AVR findings with the Cybersecurity Extension for SAP (CES) from Layer Seven Security, organizations gain consolidated visibility into vulnerabilities across their SAP landscapes. Combined with real-time security monitoring and threat detection for SAP BTP and Cloud Foundry, CES helps organizations identify risks, prioritize remediation, and respond to emerging cyber threats.
PHP2Shell Exposes Security Risks in SAP BTP Applications
The recent disclosure of PHP2Shell, a pair of critical vulnerabilities affecting PHP runtimes, has highlighted the growing cybersecurity risks facing applications deployed on SAP Business Technology Platform (BTP). The vulnerabilities, tracked as CVE-2026-109618 and CVE-2026-109619, can enable unauthenticated attackers to execute malicious code remotely, potentially compromising applications, exposing sensitive data, and disrupting business operations.
PHP2Shell is particularly concerning for organizations operating custom PHP applications on SAP BTP Cloud Foundry. Although the vulnerabilities do not directly affect SAP BTP itself, applications deployed with vulnerable PHP runtimes may be exposed. Attackers who successfully compromise these applications could potentially access connected SAP services, business data, or technical credentials, depending on the permissions and integrations available to the affected applications.
PHP2Shell is not an isolated example. Other vulnerabilities disclosed in October demonstrate the broader security challenges associated with libraries and components commonly used in SAP cloud applications. This includes:
- CVE-2026-89111 is a critical server-side request forgery (SSRF) vulnerability in the SAP Cloud SDK for Python, with a CVSS score of 10.0. The vulnerability affects OAuth2 token handling in multitenant BTP applications and could allow attackers to redirect authentication requests to malicious servers, exposing sensitive client credentials.
- CVE-2026-89105 is an authentication vulnerability in SAP’s cloud-security-services-integration-library. It affects the HybridTokenAuthenticator component, which may accept tokens from unintended SAP Identity Authentication Service (IAS) or XSUAA service bindings, potentially allowing unauthorized access.
These vulnerabilities demonstrate that security risks in SAP BTP environments extend beyond platform configurations and infrastructure. Application runtimes, third-party dependencies, open-source libraries, and authentication components can introduce vulnerabilities that threaten the confidentiality and integrity of business-critical SAP applications.
As organizations accelerate the development and deployment of applications on SAP BTP, automated vulnerability scanning is becoming an essential component of SAP cybersecurity. Security teams need to identify vulnerable components, determine which deployed applications are affected, and prioritize remediation before attackers exploit known weaknesses.
SAP BTP Application Vulnerability Report
SAP introduced the Application Vulnerability Report (AVR) in December 2025 to help customers identify and remediate known security vulnerabilities in custom applications deployed to the SAP BTP Cloud Foundry runtime.
AVR addresses an important gap in application security testing. While development tools and CI/CD security scanners typically examine applications during the software development process, AVR analyzes applications that have already been deployed.
This approach is especially valuable for identifying vulnerabilities in applications that were deployed months or years earlier, including those that may no longer be actively maintained.
AVR examines deployed application artifacts, including their software components and dependencies, to identify known vulnerabilities. The service currently performs scans on a weekly basis and consolidates the results into a central vulnerability report.
Introduced as a beta service, AVR was initially limited to Cloud Foundry applications in selected European landscapes. In May 2026, SAP expanded scanning coverage to additional Cloud Foundry landscapes worldwide. The service continues to use a central subscription model based in the EU10 region, with scanning availability subject to supported landscape and regional restrictions.
The service provides security teams with a centralized view of vulnerabilities affecting their deployed Cloud Foundry applications without requiring an agent inside each application. Administrators enable scanning by granting SAP’s designated scanner identity the Space Auditor role in the Cloud Foundry spaces they want monitored.
Comprehensive Vulnerability Detection Using OSV and Other Security Scanners
One of AVR’s most important capabilities is its use of multiple vulnerability intelligence sources and scanning technologies.
AVR incorporates Open Source Vulnerabilities (OSV) scanning capabilities alongside Trivy, commercial vulnerability intelligence, SAP BTP-specific security checks, and scanning capabilities focused on emerging threats.
OSV is an open-source vulnerability database that aggregates security advisories from multiple ecosystems and authoritative sources. The OSV database currently contains more than 2.5 million vulnerability records, providing extensive information about security weaknesses in software packages, libraries, dependencies, and operating system components.
OSV vulnerability records include information such as affected software versions, vulnerability identifiers, severity information, and available fixes. Its standardized data model helps scanners match software dependencies against known vulnerabilities.
By incorporating OSV into its scanning architecture, AVR can identify vulnerable open-source components in deployed Cloud Foundry applications. Trivy and other scanning technologies further extend the range of vulnerability sources and security checks available to the service.
This layered scanning approach helps identify risks across applications built using Java, JavaScript, Python, PHP, .NET, and other technologies supported by Cloud Foundry.
AVR provides an important mechanism for keeping pace with an expanding volume of published vulnerabilities without requiring security teams to manually inspect every deployed application’s dependencies.
Reviewing Vulnerabilities and Taking Remediation Actions
AVR findings are available through the Manage Findings application in the SAP BTP Cockpit, as well as through a REST API for automation and integration with external security platforms.
The Manage Findings application provides a consolidated dashboard of detected vulnerabilities, including a breakdown by severity. Security teams can search, sort, and filter results to identify affected applications and focus on the most significant risks.
Each finding provides detailed information, including:
- Vulnerability identification: CVE identifiers, descriptions, and vulnerability intelligence sources.
- Risk assessment: CVSS scores, severity ratings, and scoring vectors.
- Affected components: Vulnerable packages, dependencies, and software versions.
- Application context: The SAP BTP subaccount, Cloud Foundry organization, space, and application associated with the finding.
- Remediation guidance: Recommended corrective actions, including updated software versions where available.
- Detection history: Information about when a vulnerability was first identified and most recently confirmed.
These details enable security teams to evaluate the potential business impact of each vulnerability and coordinate remediation with application developers, DevOps teams, and SAP BTP administrators.
For example, if AVR identifies a vulnerable version of a software library, the application owner can review the recommended update, modify the relevant dependency, rebuild the application, and redeploy the corrected artifact.
Similarly, when vulnerabilities affect application runtimes, such as PHP2Shell, remediation may require updating the underlying runtime or buildpack and rebuilding or restaging the affected application.
The AVR interface is read-only, so remediation activities are performed through the appropriate development, deployment, and security management processes rather than directly within the findings dashboard.
The REST API also enables customers to integrate findings with external ticketing systems, reporting tools, and automated remediation workflows.
Following corrective action, subsequent AVR scans can help verify whether previously identified vulnerabilities remain present in deployed applications.
Integrating AVR Findings with the Cybersecurity Extension for SAP
Although AVR provides valuable visibility into vulnerabilities affecting SAP BTP Cloud Foundry applications, most organizations operate much broader SAP landscapes.
Business-critical processes frequently depend on interconnected SAP S/4HANA, ECC, SAP HANA, SAP NetWeaver, SAP Cloud Connector, and SAP BTP environments. Vulnerabilities in any of these components can potentially create risks for connected systems and sensitive business information.
Managing these risks through separate security tools and isolated vulnerability reports makes it difficult for security teams to maintain a comprehensive understanding of their overall SAP security posture.
The Cybersecurity Extension for SAP (CES) addresses this challenge by integrating AVR findings into broader vulnerability management capabilities.
Through this integration, CES provides customers with insights into vulnerabilities detected in their SAP BTP Cloud Foundry applications alongside security weaknesses affecting other components of their SAP landscapes.
This consolidated approach helps organizations:
- Identify and assess vulnerabilities across SAP cloud, on-premise, and hybrid environments.
- Review SAP BTP application vulnerabilities alongside risks affecting SAP application servers, databases, hosts, and integration components.
- Prioritize remediation based on vulnerability severity, affected systems, and potential business impact.
- Coordinate vulnerability management and corrective actions across SAP Basis, security, development, and infrastructure teams.
- Improve cybersecurity reporting and visibility across the enterprise SAP landscape.
The integration enables customers to extend their existing SAP vulnerability management processes to include custom applications deployed on BTP, reducing the fragmentation associated with managing separate security technologies.
CES also provides automated vulnerability scanning, patch management, configuration and compliance monitoring, custom code security, and threat detection capabilities for supported SAP solutions.
Going Beyond Vulnerability Scanning with SAP BTP Threat Detection
Identifying vulnerabilities is only one part of an effective cybersecurity strategy. Organizations must also monitor their SAP environments for suspicious activities and potential security incidents, particularly when vulnerabilities are actively exploited or cannot be remediated immediately.
The Cybersecurity Extension for SAP complements AVR vulnerability scanning by monitoring security-relevant events from SAP BTP and Cloud Foundry logs and generating alerts for potential security incidents. CES integrates with the SAP BTP Audit Log Management Service and Cloud Foundry APIs to collect and analyze security events across SAP BTP environments.
Its threat detection capabilities monitor activities such as unauthorized or suspicious authentication attempts, changes to privileged roles and permissions, modifications to identity providers and trust configurations, service credential activity, and security-sensitive application lifecycle changes. For Cloud Foundry environments, CES can also detect changes affecting application deployments, service instances, service keys, buildpacks, organizations, and spaces.
These monitoring capabilities are particularly important for incidents involving compromised applications or technical credentials. For example, a vulnerable application may be used as an entry point to access connected services, retrieve credentials, or perform unauthorized operations in SAP BTP. By combining AVR vulnerability findings with CES security event monitoring, organizations can gain visibility into both known security exposures and suspicious activities that may indicate attempted or successful exploitation.
Vulnerability scanning helps answer which applications are exposed. Security monitoring helps determine whether activity in the environment warrants investigation. Together, these complementary capabilities support a more proactive approach to SAP cybersecurity.
CES can also integrate security alerts with enterprise SIEM platforms, including Microsoft Sentinel, Splunk, and IBM QRadar, helping security operations teams incorporate SAP-specific threats into centralized incident detection and response processes.
Strengthening SAP BTP Security with Integrated Vulnerability Management
The disclosure of PHP2Shell and vulnerabilities such as CVE-2026-89111 and CVE-2026-89105 reinforces the importance of maintaining visibility into the software components and dependencies used by SAP BTP applications.
As organizations increasingly rely on custom cloud applications to extend SAP business processes, traditional security controls focused exclusively on SAP application servers, databases, or infrastructure are no longer sufficient.
SAP’s Application Vulnerability Report represents an important addition to SAP BTP security by providing automated vulnerability scanning of deployed Cloud Foundry applications using OSV and other vulnerability intelligence sources.
By integrating AVR findings with the Cybersecurity Extension for SAP, customers can incorporate SAP BTP application vulnerabilities into a unified approach to cybersecurity across their SAP landscapes.
Combined with CES threat detection and monitoring for SAP BTP and Cloud Foundry, this approach enables organizations to identify vulnerable applications, prioritize remediation, detect suspicious activities, and respond more effectively to emerging security threats.
Frequently Asked Questions (FAQ)
1. What is the SAP BTP Application Vulnerability Report (AVR)?
The Application Vulnerability Report (AVR) is an SAP BTP security service that identifies known vulnerabilities in custom applications deployed to the Cloud Foundry runtime. It automatically scans deployed application components and dependencies and provides centralized reports containing vulnerability descriptions, severity ratings, affected software packages, and remediation recommendations.
2. How does AVR detect vulnerabilities in SAP BTP applications?
AVR uses multiple vulnerability scanning technologies, including OSV and Trivy, together with commercial vulnerability intelligence and SAP BTP-specific security checks. It compares deployed application components and dependencies against known vulnerabilities to identify security weaknesses, including those associated with vulnerable open-source libraries, frameworks, and runtimes.
3. How frequently does AVR scan SAP BTP applications?
AVR performs automated vulnerability scans on a weekly basis. Unlike traditional security scanning tools that analyze applications during development, AVR examines applications already deployed to the Cloud Foundry runtime. This helps organizations identify newly disclosed vulnerabilities in existing applications, including those that have not been updated recently.
4. Can AVR detect vulnerabilities such as PHP2Shell?
AVR can help identify known vulnerabilities in deployed application runtimes and software dependencies, provided the affected components and vulnerabilities are supported by its scanning capabilities. For vulnerabilities such as PHP2Shell, organizations should use AVR findings alongside software inventory, security advisories, and patch management processes to identify and remediate potentially exposed applications.
5. How can organizations review and remediate vulnerabilities identified by AVR?
Security teams can review vulnerabilities through the Manage Findings application in the SAP BTP Cockpit or retrieve findings through the AVR REST API. Reports include CVE identifiers, CVSS scores, affected components, and remediation guidance. Application owners can use this information to prioritize security updates, rebuild affected applications, and redeploy corrected software. Subsequent scans help verify remediation.
6. Does AVR provide vulnerability scanning across the entire SAP landscape?
No. AVR focuses on custom applications deployed to supported SAP BTP Cloud Foundry environments. It does not provide comprehensive vulnerability coverage for SAP S/4HANA, ECC, NetWeaver, HANA databases, or operating systems. Organizations require additional security capabilities to identify and manage vulnerabilities across these components.
7. How does the Cybersecurity Extension for SAP integrate with AVR?
The Cybersecurity Extension for SAP (CES) from Layer Seven Security integrates AVR findings into its broader vulnerability management capabilities. This allows organizations to review vulnerabilities affecting SAP BTP Cloud Foundry applications alongside security weaknesses in SAP application servers, databases, hosts, and other supported SAP components. The integration provides consolidated visibility into cybersecurity risks across cloud, on-premise, and hybrid SAP landscapes.
8. Can the Cybersecurity Extension for SAP detect security incidents in SAP BTP?
Yes. In addition to vulnerability management, CES monitors security-relevant events from SAP BTP and Cloud Foundry logs to identify potential security incidents. This includes suspicious authentication activity, unauthorized privilege changes, modifications to service credentials, and security-sensitive configuration or application changes. CES generates alerts for detected threats and can forward security events to enterprise SIEM platforms such as Splunk, Microsoft Sentinel, and IBM QRadar.
9. What is the difference between vulnerability scanning and threat detection in SAP BTP?
Vulnerability scanning identifies known security weaknesses that attackers could potentially exploit, while threat detection monitors system activities for indications of suspicious or malicious behavior. AVR provides vulnerability scanning for deployed Cloud Foundry applications, while CES complements these capabilities with SAP BTP and Cloud Foundry security monitoring. Together, they help organizations identify security exposures, prioritize remediation, and detect potential attacks.
10. How can organizations improve SAP BTP security with AVR and CES?
Organizations can strengthen SAP BTP security by combining AVR’s automated application vulnerability scanning with the broader vulnerability management and threat detection capabilities of CES. This integrated approach provides greater visibility into vulnerabilities across interconnected SAP environments, supports risk-based remediation, and enables continuous monitoring for security incidents affecting business-critical applications and services.