Loading story…
Defensive testing of SAP NetWeaver AS ABAP 7.52 found that the SAP Security Audit Log (SAL) does not capture the operating-system command or runtime arguments executed through external-command transactions SM49 and SM69, including commands launched via RFC. SAP invokes these commands through sapxpg under the SAP <sid>adm account, and supplied runtime parameters can alter behavior beyond what is apparent in a static SM69 command definition.
Background-job logs retain the command, parameter string, and output, but SAL remains incomplete for host-level execution activity. OS-level auditd telemetry captured the full process chain and argument vector across dialog, RFC, and background execution paths when persistent execve auditing was enabled. Organizations should collect OS process-execution logs, limit SAP external-command privileges, monitor command-definition changes, and avoid treating SAL as the sole source of evidence for SAP host activity.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
Defensive testing in a self-owned SAP NetWeaver AS ABAP lab found that SAP Security Audit Log entries did not capture the executed operating-system binary or runtime arguments for external commands launched through SM49/SM69 or RFC. The testing showed OS auditd could capture the sapxpg process chain and full argument vector when execve auditing was enabled.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
SAP released its September 2026 security updates, led by **CVE-2026-44756** (OVERPASS), a CVSS 10.0 memory-corruption vulnerability in Extended Passport Processing (EPP). The flaw results from inadequate boundary validation while deserializing EPP data in shared SAP kernel code; a crafted malformed EPP header can trigger unsafe memory handling. An unauthenticated remote attacker may execute operating-system commands with SAP privileges, access secrets and active sessions, and alter SAP data, configuration, or binaries before standard authorization controls apply. The vulnerable code can be reached through web requests, SAP GUI, and RFC connections, making both internet-facing and internally exposed SAP environments relevant. SAP issued Security Note **3747649** and also published fixes for other critical issues affecting NetWeaver and multitenant Cloud Application Programming Model applications; the wider advisory covers several SAP products, including NetWeaver Message Server, GUI for Java, Integration Suite, and ABAP platforms. Organizations should promptly apply the supported kernel correction and all applicable September patches, then validate affected systems; no active exploitation of CVE-2026-44756 had been reported.
Sep 11, 2026
SAP patched **CVE-2025-31324**, a critical `CVSS 10.0` flaw in **SAP NetWeaver Visual Composer** that lets unauthenticated attackers send crafted HTTP `POST` requests to `/developmentserver/metadatauploader`, upload arbitrary files, and achieve remote code execution. Security researchers and national CSIRT reporting said the bug was actively exploited against exposed, high-value SAP systems, with attackers planting **JSP webshells** for persistent remote access and using the compromise to fully take over affected servers. SAP addressed the issue in **Security Note `3594142`** and urged customers to patch immediately or temporarily reduce exposure by disabling Visual Composer, disabling the `developmentserver` alias, and restricting access to the vulnerable endpoint. A second NetWeaver Visual Composer flaw, **CVE-2025-42999**, was later fixed in **Security Note `3604119`** after reports that attackers were chaining it with the first bug for stealthier post-compromise activity. That deserialization vulnerability requires high privileges but can also lead to arbitrary file upload and code execution, and researchers said exploitation had been observed since at least January 2025. Reporting linked the campaign to multiple threat actors, including **BianLian** and **RansomEXX**, with intrusions involving tools such as **Brute Ratel** and **Heaven's Gate** techniques to evade detection, prompting defenders to review uploaded files, inspect logs, and hunt for unauthorized webshells and follow-on payloads.
Jul 24, 2026
SAP disclosed **CVE-2026-58240** (also tracked as S4GET), a critical missing-authentication and trust-validation flaw in SAP NetWeaver Message Server, rated **CVSS 9.8**. An unauthenticated attacker able to reach the Message Server’s public SAP GUI-facing port can send a crafted packet, cause an IP address to be trusted across an SAP cluster, and bypass Gateway trust boundaries. The resulting rogue component registration or trusted-peer impersonation can enable interception, alteration, redirection, or disruption of SAP inter-component traffic and may lead to remote code execution as the SAP operating-system account `<sid>adm`. Affected deployments include SAP NetWeaver Message Server components on kernel versions **9.16, 9.18, 9.19, and 9.20**. SAP issued the definitive remediation in **Security Note 3759472**; organizations should apply it immediately, identify and restrict Message Server public-port exposure—especially Internet exposure—and review cluster and Gateway trust configurations. No confirmed in-the-wild exploitation or CISA KEV listing had been reported at publication, but the public network attack surface and likelihood of rapid weaponization make this a high-priority patching issue.
Sep 9, 2026