Second Tuesday of the month, SAP Security Patch Day, and somewhere in every SAP shop a person opens the list and starts reading. September is markedly shorter than August: 20 items against 31 a month ago, made up of 19 new SAP Security Notes and one update to an August note. The split is 4 critical, 5 high, 10 medium and 1 low. It reads like a quiet month, and that is exactly what makes it awkward.
At the top sits note 3747649 (CVE-2026-44756) at CVSS 10.0, the ceiling of the scale. The memory corruption flaw lives in SAP Extended Passport (EPP) Processing, and the fix ships at kernel and SAP Web Dispatcher level. The score is arithmetic rather than rhetoric: network attack, no privileges required, low complexity, changed scope, full impact on confidentiality, integrity and availability. This is the second 10.0 in two consecutive months - the first two such months of 2026.
The short version:
1/ note 3747649 at CVSS 10.0 affects selected kernel releases (KERNEL 7.22 through 9.20, KRNL64NUC and KRNL64UC) and the Web Dispatcher (WEBDISP 9.16-9.20), so deploying it means a kernel swap and an instance restart, not a transport import,
2/ the four critical notes sit in four different layers: the kernel, the Message Server, an npm package inside a CAP application on SAP BTP, and SAP GUI for Java on the end user’s desktop,
3/ the 10.0 flaw lives in the diagnostic path rather than in a business function - there is no module to switch off and no authorisation to revoke,
4/ NIS2 counts 24 hours to an early warning and 72 hours to a significant incident report from detection; in Poland, where NIS2 is implemented through the national cybersecurity act (KSC), essential and important entities must file for registration by 3 October 2026.
What shipped on 8 September
The full list runs to 20 items. Below are the ones that usually decide the order of work.
| Note | CVE | CVSS | Component | What to remember |
|---|---|---|---|---|
| 3747649 | CVE-2026-44756 | 10.0 | SAP Extended Passport (EPP) Processing - kernel and Web Dispatcher | Unauthenticated, network-reachable, scope changed; the remedy is a new kernel |
| 3759472 | CVE-2026-58240 | 9.8 | SAP NetWeaver (Message Server), KERNEL 9.16-9.20 | Application servers are not properly authenticated when they register |
| 3798315 | CVE-2026-76969 | 9.4 | @sap/cds-mtxs library (SAP Cloud Application Programming Model) | Credential disclosure; the fix is an npm version bump, not a note in ABAP |
| 3781729 | CVE-2026-66768 | 9.0 | SAP NetWeaver (SAP GUI for Java), BC-FES-JAV 8.10 | The patch lands on the user’s workstation, not on a server |
| 3772411 | CVE-2026-58243 | 8.8 | SAP ABAP Developer Tools, SAP_BASIS 750-920 | The month’s single update to an August note |
| 3792978 | CVE-2026-76958 | 8.5 | SAP Integration Suite (Cloud Integration) | XML External Entity in B2B exchange |
| 3784138 | CVE-2026-76967 | 7.8 | SAP NetWeaver Business Client, BC-WD-CLT-BUS 8.00 and 8.10 | Insecure deserialisation - another client-side component |
| 3757002 | CVE-2026-66767 | 7.7 | SAP NetWeaver AS ABAP / ABAP Platform, KERNEL 7.22-9.20 | The month’s second kernel-level fix |
| 3791068 | CVE-2026-2332 | 7.4 | SAP Commerce Cloud (Search and Navigation) | CRLF injection through bundled Jetty components, so code SAP did not write |
The remaining items are mostly application-layer: SQL injection in intercompany matching and reconciliation in SAP S/4HANA, server-side request forgery in SAP Manufacturing Integration and Intelligence, three CSRF notes in SAP S/4HANA Finance for Advanced Payment Management, clickjacking in SAPUI5, and a single low-severity denial of service in the SOAP adapter of SAP Process Integration.
One note on sources, because they disagree this month. Onapsis, writing on the same day, counts 22 notes and five critical items. We use the figures from the SAP support portal - 20 items and four critical - because the portal decides what is on the list; the gap most likely comes from counting updates to notes released in earlier months.
Four critical notes, four different owners
August was a month about volume: 31 items, six notes in a single manufacturing layer, a lot of reading. September is about something harder to handle. A shorter list spreads itself across four teams at once.
Kernel and Web Dispatcher (note 3747649, 10.0). Deployment means swapping the kernel and restarting instances. That is a maintenance window, a conversation with the business and a regression test - a decision made with a calendar, not with a click. Note 3757002 at 7.7 sits in the same layer, so both can close in a single window, provided somebody notices before two separate ones get scheduled.
Message Server (note 3759472, 9.8). This is the internal communication layer between instances of the same system. There is no screen, no user and no transaction here, so it never surfaces in a conversation about business risk. The Message Server does not sufficiently verify the authenticity of application servers that register with it.
An npm package inside a CAP application (note 3798315, 9.4). The @sap/cds-mtxs package handles multitenancy in applications built on the SAP Cloud Application Programming Model. The owner is a development team on SAP BTP, the remedy is a version bump, and the whole thing happens in a code repository and a deployment pipeline. The Basis team has neither the tooling nor the access.
SAP GUI for Java (note 3781729, 9.0). The patch lands on the end user’s workstation. In many organisations that layer has no patch cycle at all, never appears on the inventory of SAP systems, and formally belongs to a desktop team that has never heard of SAP notes.
The sentence worth taking away: four critical notes, four different owners - and not one of them sits in the team that receives the note list on the second Tuesday of the month.
That is precisely where the process breaks. Not at installing the fix, but at establishing who installs it. The usual path assumes one recipient and one channel: note, triage, transport, maintenance window. An item that does not fit that channel is not rejected - it simply has nobody to be handed to. In the register it looks like every other row, except that nobody ever closes its status, because nobody has the access to.
The flaw sits in the diagnostic path, not in a business function
SAP Passport is an extension to SAP’s communication protocols - a GUID plus trace flags, injected on the client side and carried from system to system across HTTP and RFC traffic. Its purpose is to let you follow a single request through an entire landscape; SAP documents the mechanism under End-to-End Trace Analysis.
The consequence is uncomfortable. When a flaw sits in a business module, there is usually an interim workaround: revoke an authorisation, disable a service, close a Fiori app until the maintenance window. Here there is nothing to switch off, because header handling is part of the kernel and the Web Dispatcher rather than a feature somebody enabled. The vector reads PR:N, so the attack needs no account, and AV:N, so network access to the component is enough. The changed scope (S:C) means the impact does not stop at the boundary of the vulnerable component.
The Web Dispatcher deserves its own sentence here, because in most architectures it stands closest to the network - it takes HTTP traffic before it reaches the application servers. An externally exposed component plus a flaw that requires no account is a combination that sets your work order for you.
What the regulation actually demands
NIS2, as implemented in Polish law through the national cybersecurity act and in force since 3 April 2026, contains no clause saying “install patches”. It requires measures proportionate to risk, and it sets deadlines: 24 hours for an early warning, 72 hours for a significant incident report, one month for the final report - all counted from detection, not from publication of the note.
This month’s spread of ownership hits that construction directly. “Measures proportionate to risk” covers the entire surface on which an organisation processes data in SAP, not only its application servers. A workstation running SAP GUI for Java and a CAP application on SAP BTP belong to that surface exactly as much as the production system does. An organisation that can document a patch process for the ABAP layer alone has documented part of its scope, not its scope.
The second consequence concerns the clock. An entity unable to detect exploitation never formally starts the deadlines, and sometimes reads that silence as safety. Regulators read it the other way round: not knowing your own state is evidence of inadequate measures, not a mitigating circumstance. Fines reach EUR 10 million or 2 percent of turnover for essential entities, EUR 7 million or 1.4 percent for important ones.
Then there is the personal data layer. If unpatched exposure leaks data out of SAP, the GDPR clock is 72 hours from becoming aware, and Article 83 allows up to EUR 20 million or 4 percent of global turnover. We covered the Polish deadlines and dependencies in a separate piece on NIS2 and the register.
And one date that has nothing to do with September’s notes and matters more than any of them: essential and important entities must file for entry in the national register by 3 October 2026. Completing that filing requires decisions many companies have not yet taken - who owns the process, which systems the filing covers and who signs it.
Check where you stand before someone else asks
SNOK KSC-CHECK is a free readiness assessment for SAP systems against NIS2 and its Polish implementation: 25 questions across 6 steps and 5 areas, 8 to 12 minutes. You get the score on screen and a PDF report by email, with a 30-day and a 12-month plan.
The five areas are event visibility, detection and response, vulnerabilities, identity and access, and evidence for audit. September lands on the vulnerability area particularly hard, because the questions there are not “do you patch” but whose job it is and what the path from published note to deployed fix looks like. With four critical notes across four layers, the answer “Basis handles that” describes a quarter of the problem.
One boundary worth stating plainly: this is a self-assessment, not an audit and not a certification of compliance. It shows where the gaps are and what to close first. It replaces neither a technical system review nor a legal determination of your entity status.
Take the KSC-CHECK assessment - and if eight minutes later it turns out your patch process is documented, staffed and evidenced across all four layers, that is the best possible outcome of this article.
How to stop starting from zero every second Tuesday
Monthly note triage is work you can do once and then automate, on one condition: the tooling has to know your landscape - versions, components, kernel level, installed packages.
That is what Patch Management in SecurityBridge does. Published notes are mapped automatically onto your specific systems, so instead of a list for the entire SAP world you get a list for yourself, with priority and deployment status. September is the textbook case, because manual triage of four critical notes scattered across four layers usually drops at least one - and statistically it is the one that does not live on a server. Mapping against actual system state also answers the opposite question, which matters just as much: what your landscape does not contain, and what you can therefore defer deliberately rather than for lack of time.
SNOK holds SecurityBridge Polska Premier Partner status, so implementation and support run in local hours and local language.
What to do this week
1/ Assign September’s four critical notes to four named people. Not to teams - to individuals with access to the right layer: kernel and Web Dispatcher (3747649), Message Server (3759472), the CAP application repository on SAP BTP (3798315), and the fleet of workstations running SAP GUI for Java (3781729). If a name does not come to mind for one of them, that is your most important finding of the month, more important than the patch itself. While you are there, check whether the kernel swap can close in a single maintenance window together with note 3757002.
2/ Take the KSC-CHECK assessment and bring the report to your next board meeting alongside the list from step one. The October deadline belongs to the board, not to IT, and scattered patch ownership is an organisational problem rather than a technical one.
The previous edition of this series, covering August’s 31 items and note 3771065, is here. If those two steps show you are short of hands or tooling, get in touch. We start with a review of the actual state, not with a quote.