SAP September Patch Day delivered 19 new Security Notes and four Critical vulnerabilities, but the defining risk is not concentrated in one product or technology. The highest-severity issues cut across infrastructure, cloud applications, and client environments.
That distribution turns patch prioritization into an architecture question. The speed of remediation increasingly depends on how clearly an organization understands where exposure sits across its SAP landscape and the dependencies that connect it.
The cost of poor visibility is also rising as AI-enabled attacks shorten the cyber defense window. September shows why: as the time available to close known weaknesses contracts, time spent locating exposure becomes part of the risk.
Architecture Determines Where Critical Risk Lands
The two highest-scoring September vulnerabilities show why architecture visibility has become part of vulnerability management. Their severity is clear, but their practical exposure depends on where affected components sit within the SAP landscape.
The SAP Extended Passport Processing flaw, CVE-2026-44756, is rated CVSS 10.0 and affects a broad range of SAP kernel and Web Dispatcher versions. Pathlock describes it as a pre-authentication memory-corruption flaw in a request-processing path shared across NetWeaver AS ABAP and Java kernels and Web Dispatcher 9.16.
The SAP NetWeaver Message Server vulnerability, CVE-2026-58240, is rated CVSS 9.8. An unauthenticated attacker with network access could connect an unauthorized server component and gain access to SAP system functions. Jonathan Stross, Sr. Product Manager, Cybersecurity R&I at Pathlock, calls Message Server “the component every application server instance in a cluster implicitly trusts.”
Pathlock places both flaws in its immediate remediation tier. Extended Passport requires visibility across affected kernel and Web Dispatcher deployments; Message Server exposure turns on whether an attacker can reach the component in the first place.
Cloud Applications Extend Visibility Into the Dependency Layer
The SAP Cloud Application Programming Model vulnerability moves the same visibility problem inside the application stack. The flaw, CVE-2026-76969, is rated CVSS 9.4, but exposure is conditional: it affects multitenant CAP applications using vulnerable versions of the @sap/cds-mtxs library with extensibility enabled.
Layer Seven Security says SAP has blocked affected endpoints for applications running on BTP Cloud Foundry. Customers still need to update the vulnerable component and redeploy affected applications, making remediation dependent on visibility into application versions and configuration.
Pathlock’s broader September analysis adds a separate supply-chain concern around compromised open-source npm packages used in SAP development tooling. Stross says at least five September items trace back to “open-source dependencies rather than SAP’s own code,” arguing for dependency inventory and version pinning as standing SAP security practices.
The issues are separate, but the implication is similar. Understanding SAP exposure increasingly requires visibility below the product level, into the software dependencies and configurations that applications inherit.
Client Software Extends the SAP Security Boundary
The fourth Critical vulnerability extends the visibility problem to the client environment. The SAP GUI for Java flaw, CVE-2026-66768, is rated CVSS 9.0 and can allow a low-privileged SAP user interacting with an untrusted system to execute unauthorized commands on the workstation. Exposure therefore depends partly on where affected clients are deployed and how they connect back into the SAP landscape.
SecurityBridge places that client-side risk in a broader September pattern. Gert-Jan Koster, SAP Security Specialist at SecurityBridge, points to patches spanning on-premise systems, client devices, and cloud services as “a clear example of the dynamic attack surface of a modern SAP landscape.” That breadth makes vulnerability management dependent on visibility across systems that may be owned and maintained by different teams.
September therefore extends the architecture question from SAP infrastructure, through application dependencies, to the devices employees use to access those environments. Gaps at any of those layers can slow the path from disclosure to remediation.
What This Means for ERP insiders
Patch Day tests architecture governance. Each monthly disclosure provides a recurring test of whether asset, dependency, and client inventories are accurate enough for rapid scoping. Repeated delays can expose structural visibility gaps before an incident does.
Ownership gaps extend the vulnerability window. When exposure crosses infrastructure, cloud development, and endpoints, remediation speed depends on how quickly responsibility moves between teams. Organizations can treat handoff delays as a security risk, not merely an operating inefficiency.
Visibility debt raises the cost of modernization. As SAP estates add cloud services and software dependencies, undocumented connections accumulate alongside technical debt. Modernization programs that improve architecture records can therefore reduce future security response time as well as migration complexity.
This article was first published by SAPinsider on September 9, 2026.
