[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fEpPV9ZI9-AUmx6E2V4dDPGvCIFa-G9dn8L_cKlR0tiQ":3},{"article":4,"iocs":44,"watch_terms":58,"solutions":59,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"4b39d701-d349-4408-9361-4764d58d1fc8","SAP Patches Critical NetWeaver, S\u002F4HANA Vulnerabilities","sap-patches-critical-netweaver-s-4hana-vulnerabilities-20e9f6","The bugs could allow attackers to invoke internal operations and execute code, completely compromising the system. The post SAP Patches Critical NetWeaver, S\u002F4HANA Vulnerabilities appeared first on SecurityWeek.","SAP has released 22 security notes, including four critical-severity vulnerabilities affecting NetWeaver, S\u002F4HANA, and Cloud SDK for Python. These flaws, with CVSS scores up to 10\u002F10, could allow attackers to exfiltrate credentials, execute arbitrary code, or fully compromise systems. SAP advises users to update their applications promptly.","SAP patches critical NetWeaver and S\u002F4HANA vulnerabilities allowing system compromise.","https:\u002F\u002Fwww.securityweek.com\u002Fsap-patches-critical-netweaver-s-4hana-vulnerabilities\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2026\u002F09\u002FSAP_vulnerability-patches.jpg","2026-10-14T06:12:10+00:00","2026-10-14T08:00:14.227842+00:00",8,[17,20,22,24,26,28],{"name":18,"type":19},"NetWeaver","product",{"name":21,"type":19},"S\u002F4HANA",{"name":23,"type":19},"Cloud SDK for Python",{"name":25,"type":19},"Visual Composer",{"name":27,"type":19},"Manufacturing Integration and Intelligence",{"name":29,"type":30},"SAP","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,39],{"category":38},{"id":31,"icon":33,"name":34,"slug":35},{"category":40},{"id":41,"icon":33,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45,49,52,55],{"type":46,"value":47,"context":48},"cve","CVE-2026-89111","OAuth2 SSRF vulnerability in Cloud SDK for Python",{"type":46,"value":50,"context":51},"CVE-2026-89110","Broken access control in NetWeaver Visual Composer",{"type":46,"value":53,"context":54},"CVE-2026-89107","Code injection issue in S\u002F4HANA",{"type":46,"value":56,"context":57},"CVE-2026-89108","Missing authorization check in Manufacturing Integration and Intelligence",[29,18,21],{"controls":60,"vendors":147},[61,90,119],{"slug":62,"name":63,"problem":64,"products":65},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":91,"name":92,"problem":93,"products":94},"patch-management","Automated patch management","Known holes get closed in days, not months.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"slug":43,"name":120,"problem":121,"products":122},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[123,131,139],{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"recorded-future","Recorded Future","\u002Fvendor-logos\u002Frecorded-future.png","recorded-future-cyber-operations","Recorded Future Cyber Operations","https:\u002F\u002Fwww.recordedfuture.com\u002Fproducts\u002Fcyber-operations","Threat intelligence built into security operations workflows, to prioritise alerts and act on threats before they arrive.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",[],{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":162},"critical-sap-netweaver-s4hana-flaws-demand-immediate-patching","Critical SAP NetWeaver & S\u002F4HANA Flaws Demand Immediate Patching","SAP has disclosed 22 vulnerabilities, including four rated critical with CVSS scores up to 10\u002F10, affecting core enterprise platforms NetWeaver, S\u002F4HANA, and Cloud SDK for Python. These flaws could allow attackers to steal credentials, execute arbitrary code, and achieve full system compromise — representing an existential risk to organizations running unpatched SAP environments. Because SAP systems frequently host sensitive financial, HR, and operational data, exploitation could lead to devastating data breaches or business disruption. The root cause lies in delayed or absent patch application across complex enterprise software landscapes where testing cycles can slow deployment. Organizations must treat critical vendor patches as emergency change requests rather than routine maintenance.",[153,154,155,156,157,158,159,160,161],"CIS Control 7: Continuous Vulnerability Management","CIS Control 2: Inventory and Control of Software Assets","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 RA-5: Vulnerability Monitoring and Scanning","NIST CSF ID.VM-1: Vulnerabilities are identified and documented","NIST CSF RS.MI-3: Newly identified vulnerabilities are mitigated or documented as accepted risks","ITIL Change Management: Emergency Change Process","SAP Security Baseline Template","ISO\u002FIEC 27001:2022 Annex A 8.8: Management of Technical Vulnerabilities",{}]