Forwarded from TWCERTCC Cybersecurity Alert TWCERTCC-200-202609-00000019

SAP released its September routine security updates, addressing a total of 20 vulnerabilities, including four high-risk security vulnerabilities (CVE-2026-44756, CVSS: 10.0; CVE-2026-58240, CVSS: 9.8; CVE-2026-76969, CVSS: 9.4; and CVE-2026-66768, CVSS: 9.0).

CVE-2026-44756: A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditions, an unauthenticated attacker may exploit specially crafted network requests to cause undefined behavior and abnormal program termination.

CVE-2026-58240: SAP NetWeaver Message Server provides insufficient authenticity verification for internal application server components during the registration process. An unauthenticated attacker with network access may be able to perform unauthorized operations within the application environment.

CVE-2026-76969: The @sap/cds-mtxs NPM library does not adequately validate certain functions used in extensibility-enabled multitenant CAP applications. An unauthenticated attacker may exploit specially crafted requests to obtain sensitive credentials.

CVE-2026-66768: SAP GUI for Java does not properly enforce trust-level policies for certain function calls from connected backend systems. A low-privileged attacker may exploit this vulnerability by manipulating the connected backend system, resulting in the execution of arbitrary commands on the victim's machine.