September patch Tuesday exposes SAP S/4HANA takeover risk

At a glance

What this is: This Patch Tuesday analysis highlights 86 Microsoft CVEs and a critical SAP S/4HANA flaw that can enable full system takeover through user-account access and RFC abuse.

Why it matters: It matters because exploitation paths that begin with ordinary account access can quickly become privileged control, which makes identity, privilege, and interface exposure part of patch prioritisation.

By the numbers:

• Microsoft released 86 new CVEs this month, and 13 are marked critical by Microsoft.
• Attackers have been observed attempting to exploit SAP CVE-2022-22536 from more than 400 IP addresses.

👉 Read Expel's September Patch Tuesday analysis of SAP S/4HANA takeover risk

Context

Patch Tuesday is not just a vulnerability list. It is a recurring signal about where attackers can turn broad software exposure into privilege escalation, especially when identity controls and administrative interfaces remain too open. In this month's roundup, the most important issue is not simply the number of CVEs, but the way a single account or exposed service can become a path to full control.

For IAM, PAM, and NHI practitioners, the intersection is direct: privileged access, service exposure, and authorization bypass often determine whether a patch gap becomes an incident. SAP S/4HANA is a good example of why application access, user entitlements, and externally reachable interfaces must be governed together rather than treated as separate operational problems.

Key questions

Q: What breaks when SAP interfaces are exposed to untrusted networks?

A: Exposed SAP interfaces can turn a standard application reachability issue into privileged command execution if authorization checks are weak or bypassed. The failure is not just technical exposure. It is a governance gap where external reach, user entitlements, and administrative authority overlap too much, allowing ordinary access to become system control.

Q: Why do privilege escalation flaws in database platforms matter so much?

A: Privilege escalation in a database is not just a local bug. It can convert an ordinary authenticated session into sysadmin control, which means the attacker can read, modify, or pivot through business-critical data. That makes authorization validation one of the most important identity controls in the database stack.

Q: How do teams know whether SAP patching has actually reduced risk?

A: Measure whether the vulnerable functionality is still reachable, whether privileged accounts were reduced, and whether logs show failed or suspicious attempts against the affected paths. A successful patch programme changes exposure, not just version numbers. If the same identities still have broad access, residual risk remains high.

Q: Who is accountable when SAP interface abuse causes outage or compromise?

A: Accountability usually sits across application owners, Basis teams, IAM, and the business owner of the process. The reason is simple: interface abuse is often enabled by role design, network reachability, and weak operational monitoring working together. If one team owns only the patch and another owns the access path, both must validate the outcome.

Technical breakdown

Why SAP RFC exposure turns a user account into system control

The SAP Remote Function Call interface is designed to let systems invoke functions remotely, but that same reach becomes dangerous when authorization checks are weak or bypassable. In CVE-2025-42957, an attacker with access to a user account can reach a vulnerable function module and inject code that executes with far broader authority than the original account should have. That is a classic privilege amplification problem: the initial access is modest, but the execution context becomes far more powerful than the identity that triggered it.

Practical implication: restrict RFC exposure and separate user access from administrative execution paths.

How elevation of privilege becomes a control-plane problem

Elevation of privilege vulnerabilities matter because they do not just expose a single host or app function. They let an attacker cross from constrained access into higher-trust actions, often SYSTEM-level control or equivalent application administration. In enterprise environments, that means the issue is not only patching code. It is also about which identities can reach management interfaces, which accounts can invoke sensitive modules, and whether those permissions are actually scoped to business need.

Practical implication: review privileged account reachability before and after patching.

Why exposed administrative ports and service interfaces widen blast radius

The post also points to NetWeaver administrative ports and similar externally reachable interfaces. When an administrative surface is internet-exposed, the security boundary shifts from internal control to public attack surface, which makes exploitability much easier. In identity terms, that surface often carries trust assumptions about who can connect, which roles can administer, and what session context is accepted. Once those assumptions break, attackers can turn a single reachable service into broad compromise.

Practical implication: harden exposed admin ports and treat public reachability as a governance defect, not just a network issue.

Threat narrative

Attacker objective: The attacker wants durable control of SAP business systems so they can steal data, manipulate transactions, or pivot deeper into the enterprise.

1. Entry occurs when an attacker reaches a vulnerable SAP interface or exposed administrative service, often through ordinary user access or internet-exposed functionality.
2. Escalation happens when code injection or authorization bypass lets the attacker execute actions beyond the original account's intended scope.
3. Impact follows when the attacker gains full control of the ERP system, enabling data theft, fraud, or use of the platform as a launch point for further attacks.

Breaches seen in the wild

• MITRE ATT&CK Enterprise Matrix — MITRE ATT&CK Enterprise — adversary tactics and techniques, threat detection, attack chain mapping, credential access, lateral movement, privilege escalation.
• Gravity SMTP CVE-2026-4020 API Keys Exposure — CVE-2026-4020 in Gravity SMTP exposes API keys via single HTTP request across 100,000 WordPress sites.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

User-level access is no longer a safe starting point in ERP security. This SAP issue shows how a normal account can become a control path when RFC interfaces and authorization checks are too permissive. The governance lesson is that identity strength and application exposure have to be assessed together, because user access can be sufficient for total compromise when the application boundary is weak.

Exposed administrative interfaces create the same risk pattern as over-privileged credentials. When NetWeaver ports or RFC endpoints are reachable from the wrong network zones, the problem is not just attack surface, but trust leakage. That is a governance failure in the access model, because the system behaves as though all callers are already trusted. Practitioners should treat externally reachable admin surfaces as identity-adjacent privilege channels.

Patch prioritisation should be driven by exploit path, not CVSS alone. A 9.9 score matters, but the real decision factor is whether the vulnerable path crosses into privileged execution or business-critical control. In SAP environments, that means ranking patches alongside account exposure, service reachability, and privileged role assignments. The practical conclusion is to prioritise any flaw that converts user access into system authority.

Privilege amplification is the named concept this patch cycle reinforces. A vulnerability creates privilege amplification when low-friction access can be transformed into materially higher control without a corresponding governance checkpoint. That pattern appears across ERP, Windows, and exposed management interfaces. The lesson for identity teams is to look for places where authentication, authorization, and execution authority are no longer aligned.

From our research:

• 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to The Ultimate Guide to NHIs.
• Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
• Related reading: 52 NHI Breaches Analysis shows how weak lifecycle control turns credential exposure into repeatable compromise patterns.

What this signals

The broader signal is that exposure and privilege cannot be managed in separate queues. When a system like SAP allows user-level access to become system-level execution, IAM and application security need a shared view of trust boundaries, especially where admin ports, RFC interfaces, and role assignments intersect.

Privilege amplification: a vulnerability becomes more dangerous when it transforms ordinary access into higher authority without an intervening governance checkpoint. That concept is now relevant across ERP, cloud management, and service account design, because the control failure is often the same even when the technology differs.

The identity lesson is reinforced by the wider NHI landscape: once machine or service credentials are in play, the risk is rarely limited to one system. Teams should use this class of issue to tighten privileged interface exposure, improve account lifecycle governance, and validate that access scope matches execution scope.

For practitioners

• Identify SAP interfaces that can be reached without strict network controls Inventory RFC endpoints, administrative ports, and any externally reachable SAP surfaces, then remove public exposure wherever business operations do not require it.
• Reassess SAP account scope against execution privilege Map user accounts that can invoke sensitive SAP functions and confirm they cannot trigger code paths that bypass authorization or escalate to system-level actions.
• Prioritise patches by privilege escalation path Put vulnerabilities that convert ordinary access into privileged execution at the top of remediation queues, even when other fixes appear more routine.
• Harden SAP administration paths separately from application access Use segmentation, role separation, and explicit admin controls so that application users, operators, and administrators do not share the same trust boundary.

Key takeaways

• This patch cycle shows that a single user account can become a full-system compromise path when application authorization is weak.
• The evidence points to real exploitation pressure, not theoretical risk, with multiple SAP vulnerabilities already seeing active attention.
• Practitioners should prioritise exposed interfaces, privileged role separation, and exploit paths that turn access into authority.

Key terms

• Privilege Amplification: A condition where a low-trust input path can influence a high-trust action path. In agentic systems, that happens when model-facing content can shape commands, commits, or credential use, allowing an attacker to get more impact than their direct access should permit.
• RFC Exposure: RFC exposure is the risk created when SAP Remote Function Call interfaces are reachable beyond the systems and users that truly need them. It matters because RFC endpoints can become execution paths if access controls, segmentation, and authorization checks are too loose or misconfigured.
• Privilege Escalation: An attack technique where a compromised identity — often an NHI with initially limited permissions — exploits vulnerabilities or misconfigurations to gain elevated access rights, typically leading to broader compromise.

What's in the full article

Expel's full analysis covers the operational detail this post intentionally leaves for the source:

• The month-by-month CVE breakdown that helps teams compare SAP risk with the broader Patch Tuesday backlog
• The specific exploit conditions behind CVE-2025-42957 and why RFC exposure changes remediation urgency
• The GreyNoise telemetry context for CVE-2022-22536, including current attacker activity patterns
• The practical patching and hardening sequence for SAP NetWeaver administrative exposure

👉 The full Expel post covers the SAP exploit path, Patch Tuesday context, and hardening guidance for exposed interfaces.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps security practitioners connect identity controls to operational risk across modern enterprise environments.