Topic starter
28/08/2026 12:04 pm
TL;DR: ERP and business application environments are facing repeated CVSS 9.9 exposures, direct exploitation of Oracle EBS and PeopleSoft, and attack paths that increasingly rely on valid access rather than classic vulnerability chaining, according to Pathlock’s review of H1 2026. The pattern shows that ERP defence now depends on continuous exposure management, application-layer monitoring, and tighter governance of both human and non-human identities.
Editorial analysis by NHI Mgmt Group, based on content published by Pathlock: “H1 2026 ERP Security Review: Three Warning Signs for What’s Coming Next”.
By the numbers:
- Five of six H2 2025 Patch Days also included at least one newly disclosed CVSS 9.9 or 10.0 vulnerability.
- The PeopleSoft campaign affected more than 100 organizations.
Key questions
Q: What breaks when ERP access is valid but the business action is not legitimate?
A: The control boundary breaks at the application layer.
Q: Why do repeated ERP vulnerabilities create more risk than isolated critical flaws?
A: Repeated flaws signal that the attack surface is continuously changing faster than manual tracking can absorb.
Q: What do security teams get wrong about ERP authentication?
A: They often treat authentication success as the end of the control story.
Practitioner guidance
- Harden externally reachable ERP components Minimise exposed interfaces, remove unused services and verify that patch coverage includes every internet-facing ERP component, connector and custom extension.
- Monitor business actions inside the application Baseline normal transaction patterns for payments, master data, privilege changes and procurement actions so abnormal activity is visible after login succeeds.
- Tighten governance for human and non-human access Review service accounts, APIs, integrations and AI agents together so each identity has only the access needed for its current business function.
Bottom line: ERP security in 2026 is being shaped by a mix of repeated critical flaws and abuse of legitimate access paths.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
28/08/2026 12:04 pm
ERP security has crossed from vulnerability management into identity governance. The article shows that repeated patch exposure is only one part of the problem. The other part is that legitimate users, integrations, service accounts and AI agents can all reach the same business workflows, which means access scope and behavioural context now matter as much as the exploit itself. Practitioners should treat ERP governance as a control model for both code exposure and identity-driven business actions.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- 19% of organisations give AI systems dramatically more access than human employees, nearly one in five granting unrestricted privilege, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should organisations govern AI agents and service accounts in ERP systems?
A: Apply the same access lifecycle discipline to non-human identities that you expect for privileged human users. Scope permissions to a single purpose, review trusted connections regularly and remove access when the workflow or integration is no longer needed. Without that discipline, automation becomes a persistent privilege path inside core business systems.
👉 Read our full editorial: ERP security in 2026: why critical apps are now top targets
This post was modified 2 days ago by NHI Mgmt Group