SAP September 2026 Patch Day: CVSS 10 Kernel Flaw and a CAP Credential Leak

Marcus Chen Staff Engineer (Backend & Cloud), YuSMP Group · Hardens enterprise and cloud stacks for US and EU teams

The short version

What SAP shipped on September 8

On its monthly Security Patch Day, September 8, 2026, SAP published 19 new Security Notes and updated one earlier note. Four carry a critical rating, and they span exactly the layers that make SAP a hard target to defend: the low-level Kernel that every ABAP system runs on, the NetWeaver Message Server that coordinates application servers, the modern Cloud Application Programming Model that new SAP apps are built with, and the SAP GUI for Java client on the desktop.

The headline number — a CVSS base score of 10.0 — belongs to CVE-2026-44756, a memory-corruption flaw in the Extended Passport (EPP) processing of the SAP Kernel and Web Dispatcher. Close behind sits CVE-2026-58240 at CVSS 9.8, a missing-authentication weakness in the NetWeaver Message Server affecting Kernel releases 9.16, 9.18, 9.19 and 9.20. A third critical issue, CVE-2026-76969 (CVSS 9.4), is a credential-disclosure bug in the sap/cds-mtxs library, and a fourth critical fix (tracked as CVE-2026-66768) lands in SAP GUI for Java. SAP's own advisory reported no known active exploitation or public proof-of-concept at the time of release.

What ties the top three together is the attack precondition, or rather the lack of one. All are reachable over the network, and the worst require no valid credentials at all. That is the profile of a vulnerability that gets scanned for at internet scale within days of disclosure — which is why SAP-heavy organizations should route this batch straight into an emergency patch window and, in parallel, review what their SAP landscape exposes at the edge.

Why the Kernel flaw scores a perfect 10

CVE-2026-44756 is, at its core, a classic input-validation failure: a buffer copy without checking the size of the input (CWE-120) inside the library that handles Extended Passport headers. An unauthenticated attacker can send a crafted network request with a malformed EPP header and push the process into undefined behavior — in practice, memory corruption that can crash or destabilize the component.

The reason it earns a full 10.0 is the combination of factors the CVSS model rewards most harshly: the attack comes over the network, needs no authentication, requires no user interaction, and can hit confidentiality, integrity and availability at once. It affects a long list of SAP Kernel releases — 7.22, 7.53, 7.54, 7.77, 7.89, 7.93 and 8.04 — plus SAP Web Dispatcher 9.16 through 9.20. Those are not obscure add-ons; the Kernel is the runtime under every ABAP-based SAP system, and the Web Dispatcher is frequently the internet-facing reverse proxy in front of it.

That placement is the whole risk story. A memory-corruption bug buried deep in an internal batch job is one thing; the same class of bug in the component that terminates external HTTP traffic is another. Organizations that expose a Web Dispatcher to the public internet — a common pattern for Fiori launchpads and B2B integrations — should treat this as the first note to apply, and confirm afterward that the patched Kernel or Web Dispatcher version is actually the one running.

The one SaaS builders should read: the CAP credential leak

Most SAP patch-day coverage stops at the infrastructure CVEs. But CVE-2026-76969 is the one that matters if you build software on SAP rather than just run it. The flaw lives in sap/cds-mtxs, the multitenancy and extensibility toolkit for the SAP Cloud Application Programming Model (CAP) — the Node.js and Java framework SAP steers partners toward for building cloud apps on Business Technology Platform. Affected versions run up to 1.18.3, 2.7.6, 3.9.6 and 4.0.2.

The bug can disclose credentials, and in a multitenant context that is a specific kind of nightmare. A CAP app that serves many customers from shared infrastructure relies on the framework to keep each tenant's secrets and connections walled off from the others. A credential-disclosure flaw in the very library responsible for that isolation raises the prospect of cross-tenant exposure — one tenant reaching data or systems that belong to another. For a multitenant SaaS product, that is not just a patch; it is a potential data-boundary incident that may need customer notification depending on what was reachable.

The action here is concrete and non-negotiable: upgrade the sap/cds-mtxs dependency to a fixed version, then work backward and check whether any tenant credentials could have been exposed while the vulnerable version was live. If your CAP app manages regulated data under GDPR or HIPAA, treat the exposure assessment as part of the fix, not a follow-up — the clock on a breach-notification obligation starts from awareness, not from when it is convenient to look.

What it means for US & EU teams on SAP

First, separate “run” risk from “build” risk, because they need different owners. The Kernel, Web Dispatcher and Message Server fixes are a Basis and infrastructure job: identify every SAP instance and its Kernel patch level, prioritize anything reachable from the internet, and schedule the update this week. The CAP fix is an application-engineering job: a dependency bump in your own codebase, a rebuild, a redeploy, and an audit of what the vulnerable library could have leaked. If your organization treats all SAP security as “the Basis team's problem,” the CAP flaw is exactly the one that falls through the gap.

Second, remember that patch day is a starting gun for attackers, not a finish line for you. Once SAP publishes a note, the fix itself becomes a map: researchers and adversaries diff the patched binaries against the old ones and reconstruct the vulnerability, often within days. “No known exploitation” on September 8 is a description of the past, not a forecast. The unauthenticated, network-facing bugs in this batch are the historical favorites for fast weaponization, and SAP systems are high-value because they sit on finance, HR and supply-chain data.

Third, use this cycle to check the boring things that decide whether patching actually works: do you have a current, accurate inventory of SAP components and their versions; can you confirm a patched version is the one running, not just downloaded; and is your Web Dispatcher exposure as small as it needs to be? Teams that run SAP as their operational core but lack an SAP-specialist bench often close the immediate CVE and miss the exposure that let it matter. A short, focused hardening review — ideally by engineers who understand both the SAP layer and the network in front of it — turns a monthly fire drill into a repeatable process.

A patch-and-harden checklist

1. Inventory first. List every SAP system with its Kernel and Web Dispatcher patch level, and flag which components are reachable from the internet.
2. Patch the unauthenticated bugs now. Apply the Kernel/Web Dispatcher (CVE-2026-44756) and Message Server (CVE-2026-58240) notes first, prioritizing edge-facing instances.
3. Bump the CAP dependency. Upgrade sap/cds-mtxs past 1.18.3 / 2.7.6 / 3.9.6 / 4.0.2 in every CAP app, then rebuild and redeploy.
4. Assess credential exposure. For multitenant CAP apps, review whether tenant credentials could have leaked and rotate anything in doubt.
5. Verify, don't assume. Confirm the patched version is the one actually running in each environment, not just staged.
6. Shrink the edge. Re-check what your Web Dispatcher and Message Server expose to the public internet and remove anything that does not need to be there.

Frequently asked questions

Sources

SAP — Security Patch Day, September 2026 (official advisory)
GBHackers — SAP September 2026 Security Update Fixes 4 Critical Vulnerabilities and 15 Other Flaws (September 8, 2026)
Cyber Press — SAP Security Patch Day Fixes 19 New Vulnerabilities Across NetWeaver, S/4HANA and Cloud Products (September 8, 2026)