Notifications
Clear all
Topic starter
25/06/2026 12:36 am
TL;DR: SAP’s October Security Patch Day bundles critical fixes for unauthenticated remote code execution in NetWeaver AS Java, directory traversal in SAPSprint, and several lower-severity but still exploitable issues across Commerce, S/4HANA, and BusinessObjects, making exposure reduction and patch sequencing the immediate priority, according to Pathlock. The practical lesson is that internet-facing SAP services, kernel components, and third-party libraries remain a high-value attack surface when patch discipline lags.
NHIMG editorial — based on content published by Pathlock: SAP’s October Security Patch Day analysis covering critical RCE and traversal issues
By the numbers:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation.
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures.
- 96% of organisations store secrets outside of secrets managers in vulnerable locations including code, config files, and CI/CD tools.
Questions worth separating out
Q: How should teams prioritise SAP patching when multiple critical notes land at once?
A: Start with unauthenticated, internet-facing flaws that can lead to remote code execution or file overwrite, then move to lower-severity application defects and internal issues.
Q: Why do SAP application flaws often become identity and governance problems?
A: Because enterprise SAP services sit inside trusted business processes, and a flaw in input handling or authorization can let an attacker act as the application itself.
Q: What breaks when third-party libraries in SAP stacks are not patched quickly?
A: The application inherits the library’s attack surface even if the business logic is unchanged.
Practitioner guidance
- Prioritise internet-facing SAP services first Patch NetWeaver AS Java, SAPSprint, and any externally reachable Commerce or integration endpoints before working through lower-risk internal items.
- Apply deserialization hardening alongside code fixes Where SAP provides JVM filters or companion hardening notes, deploy them with the patch rather than treating them as optional defence in depth.
- Rebuild and redeploy affected SAP packages after library updates Do not assume dependency patching is complete once a note is applied.
What's in the full analysis
Pathlock’s full post covers the operational detail this post intentionally leaves for the source:
- Exact SAP Note references and component versions for each affected product family.
- Patch ordering guidance for teams balancing NetWeaver, Commerce, S/4HANA, and BusinessObjects workstreams.
- Mitigation notes for interim hardening, including P4 isolation, JVM filters, and ticketing workarounds.
- Release-specific update guidance for administrators who need to validate regressions before redeployment.
👉 Read Pathlock’s October SAP patch day analysis for critical RCE and traversal fixes →
SAP patch day: which fixes should security teams prioritise first?
Explore further
25/06/2026 9:30 am
Patch day risk in SAP is really identity boundary risk: These flaws matter because they let unauthenticated or low-privilege actors cross boundaries that enterprise governance assumes are already enforced. Once a service accepts unsafe input, the control failure is not only technical patch lag but misplaced trust in the application perimeter. For SAP estates, the practitioner conclusion is that exposure management and authorization design have to be treated as one problem, not two.
A few things that frame the scale:
- 91.6% of secrets remain valid five days after the targeted organisation is notified, showing a critical gap in remediation procedures, according to the Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
A question worth separating out:
Q: Who should be accountable for SAP exposure when a critical flaw is public?
A: Application owners, platform teams, and security operations should share accountability, but the control owner must be explicit. If a service is reachable from the internet, the team responsible for exposure management should confirm patch status, segmentation, and interim hardening. Governance fails when everyone assumes another team owns the risk.
👉 Read our full editorial: SAP patch day exposes critical RCE and traversal risks
