Securing SAP BTP Applications with the Application Vulnerability Report and Cybersecurity Extension for SAP
Executive Summary Recent vulnerabilities such as PHP2Shell have exposed growing security risks in SAP BTP applications, highlighting the need for automated vulnerability scanning and threat detection. SAP’s Application Vulnerability Report (AVR) addresses these risks by scanning deployed Cloud Foundry applications for known vulnerabilities using OSV and other security intelligence sources. By integrating AVR findings with […]
PHP2Shell: Securing PHP Applications in SAP Environments
Summary The PHP project released security updates on 21 October 2026 for CVE-2026-109618 and CVE-2026-109619. The critical vulnerabilities can enable unauthenticated attackers to execute arbitrary code remotely in vulnerable PHP web runtimes. Successful exploitation could allow an attacker to compromise affected web applications and servers, access data available to the PHP process, disrupt application availability, […]
SAP OVERPASS Update: New Attack Paths Identified and Public Exploit Toolkit Released
SAP OVERPASS (CVE-2026-44756) remains an urgent patching priority for SAP solutions. As reported in our advisory earlier this month, the vulnerability affects the processing of SAP Extended Passport (EPP) data in shared SAP Kernel code. It can enable attackers to execute arbitrary operating system commands with SAP service account privileges by triggering memory corruption through […]
SAP OVERPASS Vulnerability: Protecting SAP Systems from CVE-2026-44756
Summary SAP issued an urgent security update this week to address the critical vulnerability CVE-2026-44756, commonly known as OVERPASS. The vulnerability has the highest possible severity rating, with a CVSS score of 10.0, and affects a wide range of SAP solutions. OVERPASS could enable threat actors to disrupt SAP services, access sensitive information, change system […]
Key Takeaways of the DBIR 2026 for SAP Solutions
BackgroundThe Verizon Data Breach Investigations Report, widely known as the DBIR, is one of the most respected annual reports in the cybersecurity industry. Published by Verizon, the report analyzes real-world security incidents and confirmed data breaches to identify attack vectors, threat actors, and defensive measures. Since its first edition in 2008, the DBIR has become […]
State-Sponsored Cyber Attacks on SAP: A Guide to Threats and Defenses
State-sponsored cyber attacks are a rapidly increasing threat to SAP solutions, driven by rising geopolitical tensions. Attackers target mission-critical SAP systems for espionage and sabotage, exploiting their wide attack surface and slow enterprise patching cycles. Defending these vital systems requires specialized vulnerability management, real-time threat detection, and a focused effort to harden specific SAP configurations […]
What’s New in the Cybersecurity Extension for SAP, Version 5.3
Version 5.3 of the Cybersecurity Extension for SAP (CES) is now available, delivering major enhancements for SAP vulnerability management and threat detection. This release introduces comprehensive monitoring for the SAP Cloud Connector, updates to key compliance frameworks including SAP RISE, and emergency patches for zero-day vulnerabilities like CVE-2025-31324. The latest release of the Cybersecurity Extension for SAP […]
SAP Vulnerabilities Actively Exploited by Ransomware: What You Need to Know
Two critical vulnerabilities in SAP NetWeaver Java, CVE-2025-31324 and CVE-2025-42999, are being actively exploited by ransomware groups and other threat actors. CISA has added both vulnerabilities to its Known Exploited Vulnerabilities catalog, signaling an urgent need for organizations to take action by applying patches or removing the affected component. The vulnerabilities exist in the Visual Composer framework of […]
What is the SAP 24-Month Patching Rule?
SAP’s 24-month rule dictates that corrective fixes for many vulnerabilities are only provided for support packages released within the last two years. This policy primarily affects security notes for issues discovered internally by SAP and means that systems running on older support packages will not receive these specific patches, requiring a full upgrade instead. Regular […]
The 24-Month Rule for SAP Security Patching
Regular patching is critical for protecting SAP software against security vulnerabilities. Security weaknesses are discovered by SAP through internal testing and testing performed by external researchers. The latter disclose vulnerabilities directly to the SAP Product Security Response Team and through the official SAP bug bounty program. Once a vulnerability is identified or reported, it is […]