Loading story…
SAP has announced a five-month extension for customers in the process of migrating from S/4HANA Compatibility Packs to native S/4HANA or cloud-based solutions. Originally, the usage rights for these Compatibility Packs were set to expire on December 31, 2025, but the new policy grants organizations that have already begun their migration until the end of May 2026 to complete the transition. This extension does not apply to customers who have not started the migration process, who will still lose access at the original deadline. SAP is also offering tailored support programs, including transformation incentives, cloud migration guidance, and dedicated services to help identify and replace Compatibility Pack functions with recommended cloud solutions.
Industry analysts have noted that while the extension is a practical response to the challenges faced by some enterprises, it is a limited reprieve and not a broad policy change. The move is intended to minimize business disruption for organizations still dependent on legacy ECC functionality, but only those actively working on migration will benefit. SAP is providing additional resources such as AI-powered tools, best-practice guides, and direct support from enterprise architects to facilitate a smooth transition to cloud-based ERP environments.
Map this exposure pattern across your cloud, code, and identities.
5 events from the most recent confirmed update back to the earliest known activity.
The final grace period announced by SAP is scheduled to expire at the end of May 2026. Organizations that fail to complete migration by then risk non-compliance, business disruption, and possible technical disablement of Compatibility Pack functionality in future releases.
In early January 2026, SAP announced a final extension through the end of May 2026 for customers that had already begun migrating away from S/4HANA Compatibility Packs. Customers that had not started migration were excluded, and SAP said it would provide tailored programs, incentives, and hands-on support to help eligible organizations finish the transition.
SAP's original deadline for Compatibility Pack support was set for December 31, 2025. After this point, customers still relying on the packs faced compliance and operational risks if they had not completed migration.
By the 2023 version of S/4HANA, SAP had made the previously missing functionality available natively, reducing the need for continued reliance on Compatibility Packs. This marked a key milestone in SAP's plan to retire the packs.
SAP introduced Compatibility Packs in 2015 to help customers moving from SAP ECC to S/4HANA retain legacy functionality during the transition. The packs were positioned as temporary support rather than a permanent feature set.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See where this exposure pattern shows up across your cloud, code, supply chain, and non-human identities.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SAP released multiple security updates addressing critical vulnerabilities across core enterprise products, including **SAP NetWeaver**, **SAP S/4HANA**, **SAP Commerce Cloud**, **SAP Business Warehouse**, **SAP Business Planning and Consolidation**, **SAP Kernel**, **ABAP Platform**, **SAP NetWeaver Application Server Java**, and **SAP Forecasting & Replenishment**. The fixes covered at least 15 vulnerabilities in both the April-to-June advisories, with several flaws rated **critical** and carrying CVSS scores from **9.0 to 9.9**. Reported impacts included **SQL injection**, **remote code execution**, **operating system command execution**, **directory traversal**, **memory corruption**, **sensitive data exposure**, **denial of service**, privilege abuse, and potential full compromise of confidentiality, integrity, and availability. Among the most severe issues, **CVE-2026-27681** affected SAP Business Planning and Consolidation and SAP Business Warehouse, allowing a low-privileged authenticated attacker to upload a file containing SQL commands and execute arbitrary database operations; SAP said a temporary mitigation was to revoke the `S_GUI` authorization object with Activity 60 (Upload) where possible. Additional high-risk flaws included **CVE-2026-34260** and **CVE-2026-34263** in SAP S/4HANA, SAP Commerce Cloud, and SAP Forecasting & Replenishment, each scored **9.6**, as well as critical June issues in NetWeaver-related components that could enable unauthorized access, file-processing abuse, and system compromise. SAP and national defenders urged organizations to apply vendor-specified patches immediately.
Jul 24, 2026
SAP released its September 2026 security updates, led by **CVE-2026-44756** (OVERPASS), a CVSS 10.0 memory-corruption vulnerability in Extended Passport Processing (EPP). The flaw results from inadequate boundary validation while deserializing EPP data in shared SAP kernel code; a crafted malformed EPP header can trigger unsafe memory handling. An unauthenticated remote attacker may execute operating-system commands with SAP privileges, access secrets and active sessions, and alter SAP data, configuration, or binaries before standard authorization controls apply. The vulnerable code can be reached through web requests, SAP GUI, and RFC connections, making both internet-facing and internally exposed SAP environments relevant. SAP issued Security Note **3747649** and also published fixes for other critical issues affecting NetWeaver and multitenant Cloud Application Programming Model applications; the wider advisory covers several SAP products, including NetWeaver Message Server, GUI for Java, Integration Suite, and ABAP platforms. Organizations should promptly apply the supported kernel correction and all applicable September patches, then validate affected systems; no active exploitation of CVE-2026-44756 had been reported.
Sep 11, 2026SAP released 25 new and updated security notes in September 2025, including fixes for several critical vulnerabilities in NetWeaver, S/4HANA, and other key products. Notable flaws include unauthenticated remote code execution (CVE-2025-42944), insecure file operations (CVE-2025-42922), and a code injection vulnerability in S/4HANA (CVE-2025-42957) that has been actively exploited. Organizations are urged to apply patches immediately and strengthen SAP security controls to prevent potential system compromise.
Jun 29, 2026