PT-2026-86954

SAP S/4HANA Finance Advanced Payment Management does not perform sufficient Cross-Site Request Forgery protection on certain requests due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be trigger...

PT-2026-86956

SAP S/4HANA Finance Advanced Payment Management does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be...

PT-2026-86951

SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing conditions. Successful exploitation coul...

PT-2026-86961

@sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and abuse them to replace or delete tenant data...

PT-2026-86959

SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during application startup. An attacker with low privileges on the local system could replace this data with specially crafted content. When the application is next launched, the craft...

PT-2026-86958

Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive system configuration information. Successful exploitation could result in exposure of security relevant settings and internal...

PT-2026-86949

SAP Process Integration SOAP Adapter allows a privileged user to send specially crafted requests containing deeply nested entity definitions, which under certain conditions could temporarily increase processor load and degrade system responsiveness. Successful exploitation results in low impact o...

PT-2026-86955

SAP S/4HANA Finance Advanced Payment Management does not perform sufficient Cross-Site Request Forgery protection on certain requests, due to this an attacker with low privileges could craft a malicious link or page. If an authenticated victim interacts with it, unintended actions could be...

SAP NetWeaver Visual Composer Metadata Uploader - Deserialization

SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confidentiality, integrity, and availabili...

CVE-2026-81832

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 SAP Adapter is vulnerable to an XML external entity XXE attack...

CVE-2026-81832 IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 SAP Adapter is vulnerable to an XML external entity XXE attack...

EUVD-2026-71152

IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1.0.7 SAP Adapter is vulnerable to an XML external entity XXE attack...

CVE-2026-81832

IBM App Connect Enterprise (versions 13.0.1.0–13.0.8.1 and 12.0.1.0–12.0.12.28) and IBM Integration Bus for z/OS (10.1.0.0–10.1.0.7) are affected through the SAP Adapter , which is vulnerable to an XML External Entity (XXE) attack. The CVSS 3.1 score is 7.7 (HIGH) with a scope-changing, network-a...

Security Bulletin: IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs

Summary IBM App Connect Enterprise and IBM Integration Bus for z/OS Adapter nodes are vulnerable to multiple CVEs. Vulnerability Details CVEID:CVE-2026-17440 DESCRIPTION: IBM App Connect Enterprise could allow a local attacker to cause a denial of service due to uncontrolled recursion. CWE:CWE-67...

PT-2026-85662

🚨 HIGH Severity Alert CVE-2026-81832 | CVSS 7.7 IBM App Connect Enterprise & Integration Bus vulnerable to XXE attack allowing confidential data exposure. Affected: ACE 12.0.1.0-12.0.12.28, 13.0.1.0-13.0.8.1 & IB for z/OS 10.1.0.0-10.1.0.7 https://t.co/Iln5WlecgQ...

Important: Red Hat Security Advisory: kernel security update

An update for kernel is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2021-21337

creationtimestamp| type| source ---|---|--- 2026-09-01 20:02:40+00:00| seen| https://t.me/hackingAttack/11108 2026-09-02 01:03:17+00:00| seen| https://t.me/hackingAttack/11108 2026-09-08 05:00:04+00:00| published-proof-of-concept| https://t.me/hackingAttack/11108 2026-09-09 00:00:41+00:00|...

Security update for google-cloud-sap-agent

This update for google-cloud-sap-agent fixes the following issue: CVE-2026-41178: go.opentelemetry.io/otel/baggage: no rejection of raw-length headers in baggage parsing allows for DoS via oversized inputs bsc1276667. Patch Instructions: To install this SUSE update use the SUSE recommended...

Important: Red Hat Security Advisory: xmlrpc-c security update

An update for xmlrpc-c is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2026-66766

SAP S/4HANA Private Cloud uses a third-party component that contains a Regular Expression Denial of Service ReDoS vulnerability. An unauthenticated attacker could supply specially crafted input that triggers excessive processing within the affected functionality. Successful exploitation could...