Notifications
Clear all
Topic starter
20/08/2026 6:08 pm
TL;DR: Microsoft released 86 CVEs this month, including 13 critical issues, while Expel highlights CVE-2025-42957 in SAP S/4HANA as a 9.9-rated code injection flaw that can lead to full system takeover when an attacker has user-level access. The pattern matters for IAM and PAM teams because privileged control and interface exposure, not just patch timing, determine how far a compromised account can move.
NHIMG editorial — based on content published by Expel: September Patch Tuesday analysis covering SAP S/4HANA code injection risk
By the numbers:
- Microsoft released 86 new CVEs this month, and 13 are marked critical by Microsoft.
- Attackers have been observed attempting to exploit SAP CVE-2022-22536 from more than 400 IP addresses.
Questions worth separating out
Q: What breaks when SAP interfaces are exposed to untrusted networks?
A: Exposed SAP interfaces can turn a standard application reachability issue into privileged command execution if authorization checks are weak or bypassed.
Q: Why do privilege escalation flaws in database platforms matter so much?
A: Privilege escalation in a database is not just a local bug.
Q: How do teams know whether SAP patching has actually reduced risk?
A: Measure whether the vulnerable functionality is still reachable, whether privileged accounts were reduced, and whether logs show failed or suspicious attempts against the affected paths.
Practitioner guidance
- Identify SAP interfaces that can be reached without strict network controls Inventory RFC endpoints, administrative ports, and any externally reachable SAP surfaces, then remove public exposure wherever business operations do not require it.
- Reassess SAP account scope against execution privilege Map user accounts that can invoke sensitive SAP functions and confirm they cannot trigger code paths that bypass authorization or escalate to system-level actions.
- Prioritise patches by privilege escalation path Put vulnerabilities that convert ordinary access into privileged execution at the top of remediation queues, even when other fixes appear more routine.
What's in the full article
Expel's full analysis covers the operational detail this post intentionally leaves for the source:
- The month-by-month CVE breakdown that helps teams compare SAP risk with the broader Patch Tuesday backlog
- The specific exploit conditions behind CVE-2025-42957 and why RFC exposure changes remediation urgency
- The GreyNoise telemetry context for CVE-2022-22536, including current attacker activity patterns
- The practical patching and hardening sequence for SAP NetWeaver administrative exposure
👉 Read Expel's September Patch Tuesday analysis of SAP S/4HANA takeover risk →
SAP S/4HANA takeover risk: what security teams should prioritize?
Explore further
20/08/2026 6:45 pm
User-level access is no longer a safe starting point in ERP security. This SAP issue shows how a normal account can become a control path when RFC interfaces and authorization checks are too permissive. The governance lesson is that identity strength and application exposure have to be assessed together, because user access can be sufficient for total compromise when the application boundary is weak.
A few things that frame the scale:
- 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, according to The Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
A question worth separating out:
Q: Who is accountable when SAP interface abuse causes outage or compromise?
A: Accountability usually sits across application owners, Basis teams, IAM, and the business owner of the process. The reason is simple: interface abuse is often enabled by role design, network reachability, and weak operational monitoring working together. If one team owns only the patch and another owns the access path, both must validate the outcome.
👉 Read our full editorial: September patch Tuesday exposes SAP S/4HANA takeover risk
