Severity Daily

IT and AI security incidents, checked against the primary source

Tag: SAP

  • Two 10.0s drew a Friday federal deadline, and in half of today’s stories the vendor contradicts its own record

    Two 10.0s drew a Friday federal deadline, and in half of today’s stories the vendor contradicts its own record

    The most important thing today is a date: Friday, September 11, 2026. CISA added two flaws scoring 10.0 to the Known Exploited Vulnerabilities catalog on September 8 and put the same three-day due date on both. Adobe Commerce is exploited in the wild by Adobe’s own statement, needs no authentication, and affects every supported branch of Commerce, B2B, and Magento Open Source. N-able N-central is pre-authentication remote code execution in the platform managed service providers point at their clients’ networks.

    The biggest-sounding story of the day is neither of them. Veradigm told the SEC that an attacker took credentials from a third-party vendor, used them against a Veradigm API, and downloaded patient data including Social Security numbers. For the people in that file it is the worst thing on the page. For anyone deciding what to do before Friday it is inert: the filing names no vendor, no date, and no count. The two KEV entries come with a deadline inside the week and something to install. That is why they lead.

    The thread

    Six of today’s twelve stories — exactly half — are a vendor’s own record disagreeing with itself. N-able’s status page says there are no confirmations of exploitation while its blog says the opposite, on the CVE CISA has now listed as exploited. Microsoft marks both of today’s Windows zero-days exploited, then ships a temporal vector on one of them reading E:U, exploit code unproven. SAP scores a flaw its record describes as a crash at 10.0 and one describing a rogue application server at 9.8, and the entire gap is one scope metric. Siemens splits one broken session token in the Reyrolle 7SR5 into three CVEs, and its own v3.1 and v4.0 vectors disagree on how hard one of them is to attack. Ivanti published three ITSM records with byte-identical descriptions and the same weakness class, two scored 8.8 and the third 9.9. Adobe stamps its ColdFusion bulletin Priority 1 and says in the same document that it is aware of no exploits.

    The score, the severity label, and the exploitation status are produced by different processes inside the same organization, and today six of them shipped out of step. The consequence is the same every time: the number you sort your queue on is not the number that tells you what to do.

    The rest, in the order it deserves attention

    Behind Friday, the same Microsoft release carries two Windows local privilege escalations at 7.8 with a September 22 federal deadline. The ColdFusion bulletin covers nine CVEs across both shipping releases. Ivanti Neurons for ITSM shipped eight CVEs, two of them unauthenticated deserialization at 9.8. Snowflake’s drivers attached a cloud workload-identity token to the login request before checking the host was Snowflake, across eight driver lines. Siemens Siveillance Control fixes a root-level file upload in which each of four editions has a different build number meaning “fixed.” On the filings side, Boston Scientific escalated to Item 1.05 and named the 2026 guidance it will miss, and United Natural Foods booked its June 2025 attack as a $21 million credit, because $45 million of insurance arrived a fiscal year after the costs it covers.

    Still open

    Adobe’s remediation for the Commerce 10.0 is a composer patch, and the bulletin’s solution column still carries no version number: agencies have until Friday to apply something they cannot cite by version. N-able has not reconciled its two live statements, and NVD’s affected list includes Hotfix 3, the build N-able told on-premises customers on September 5 to install immediately. Fourteen days after the attack, Boston Scientific still has not said whether anything was taken. Veradigm has not named the vendor whose credentials were stolen, or how many people are in the file.

    Sourcing note: this page adds no facts to the stories it links; each carries its own primary source. The September 11 and September 22 deadlines were re-confirmed tonight against NVD, which republishes CISA’s cisaExploitAdd and cisaActionDue verbatim. NVD was inconsistent while that was done: within one hour the same API returned a stale copy of CVE-2026-75650 with no CISA fields and then the current record at lastModified 2026-09-08T19:29:17.803 carrying them, and returned totalResults of 0 for both Windows CVE IDs on two query forms before returning the full records on a third. All four deadlines are confirmed. The lesson for anyone checking these dates themselves is that a single empty NVD response is not evidence of anything — query again before concluding a record is missing. cisa.gov blocks automated fetching directly.

    Correction, September 8, 2026: an earlier version of this sourcing note, live for roughly three minutes after publication, said NVD “returned no record at all for either Windows CVE at the time of writing.” That described two failed queries, not the state of the catalog. Both records were retrieved in full on a retry and carry a cisaActionDue of 2026-09-22. The note above has been rewritten.

  • SAP scores a described crash 10.0 and a described takeover 9.8, and the whole gap is one scope metric

    SAP scores a described crash 10.0 and a described takeover 9.8, and the whole gap is one scope metric

    SAP’s September patch day put a 10.0 on a flaw its own record describes as a crash, and a 9.8 on one its own record describes as an attacker registering a rogue application server.

    What happened

    SAP released its September 2026 Security Patch Day on Tuesday, September 8. Seventeen CVE records carrying SAP’s CNA identifier, [email protected], entered the National Vulnerability Database in a single batch at 1:17 a.m. UTC that morning. Two of them sit in the SAP kernel, and the pair is worth reading side by side.

    The higher-scored of the two is CVE-2026-44756, covered by SAP Note 3747649. SAP’s description of it reads, in full: “A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditions, an unauthenticated attacker could exploit a crafted network request containing a malformed EPP header, potentially resulting in undefined behavior and abnormal program termination.” The assigned weakness is CWE-120, buffer copy without checking the size of input.

    SAP scored it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — a base score of 10.0, the maximum the framework produces.

    The second is CVE-2026-58240, covered by SAP Note 3759472, in the NetWeaver Message Server. SAP’s description: “SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system.” The weakness is CWE-308, use of single-factor authentication.

    SAP scored that one CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — 9.8.

    Every metric in the two vectors is identical except one. Attack vector, attack complexity, privileges required, user interaction, and all three impact metrics match. The only difference is scope: S:C on the Extended Passport flaw, S:U on the Message Server flaw. That single character is the entire 0.2 separating them. Strip the scope change from CVE-2026-44756 and it scores 9.8, the same as the other.

    The affected lists are release names, not patch levels. CVE-2026-44756 names KRNL64NUC 7.22 and 7.22EXT, KRNL64UC 7.22, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, and 8.04, and WEBDISP 9.16, 9.18, 9.19, and 9.20. CVE-2026-58240 names KERNEL 9.16, 9.18, 9.19, and 9.20. Neither record carries a fixed version, a solution field, or a workaround. Each has exactly two references: the SAP note, and the generic patch day landing page at url.sap/sapsecuritypatchday. An unauthenticated fetch of me.sap.com/notes/3747649 returned no readable content — SAP notes require an S-user login, so the patch level that actually closes either flaw is not publicly stated anywhere.

    Both records were in NVD status “Received” as of Tuesday morning, meaning NVD had not analyzed them: no CPE data, no NVD-assigned score, and no CISA-ADP secondary score. SAP’s own numbers are the only numbers.

    Why it matters

    Scope is the CVSS v3.1 metric with the least agreement behind it. The specification defines a scope change as an impact that crosses a security authority boundary — the vulnerable component and the impacted component are not the same. In practice, different CNAs read that boundary differently, and there is no test that settles it. It is also the metric with the largest single effect on the final number, which is why it ends up carrying arguments that are really about something else.

    Here the argument is visible in the prose. SAP’s description of CVE-2026-44756 stops at “undefined behavior and abnormal program termination.” That is a crash. A crash supports A:H. It does not, on its own text, support C:H or I:H, let alone a scope change that lifts the total to a perfect 10.0. CWE-120 makes the full-compromise reading plausible — a buffer copy without a length check is the canonical path from crash to controlled write to code execution — but the record does not say that. It says the program terminates abnormally.

    Meanwhile the record that does describe a full compromise in plain words, where an unauthenticated attacker registers an unauthorized application server component and gets high confidentiality, integrity, and availability impact, is the one scored lower. Read the two descriptions with the scores hidden and most readers would rank them the other way around.

    This is not a pedantic complaint, because almost nothing downstream reads the prose. Vulnerability scanners ingest the vector. Ticketing systems sort on the base score. Patch windows are negotiated against a number, and a 10.0 wins that negotiation against a 9.8 every time, in every organization, without anyone opening the record. The team that patches by score patches the described crash first and the described takeover second.

    The Message Server flaw also has more history behind it than its score suggests. The message server is the component SAP application server instances register with to find each other; its internal port is meant to be reachable only from the application server subnet, and the access control list governing which hosts may register has been the subject of SAP guidance for years. CWE-308 — single-factor authentication — is the CNA saying the registration handshake proves less than it should. An attacker who can reach that port and register as an application server is inside the trust boundary of the system, not knocking on it.

    The second problem is the one Severity Daily keeps finding across vendors: the record tells you what is broken and refuses to tell you what fixes it. SAP kernels are versioned by release and patch level, and the patch level is the only thing that matters for remediation. The CVE record gives the release. The patch level lives in the note, and the note is behind a customer login. For an SAP customer with an S-user, this is a mild annoyance. For everyone else who has to reason about SAP exposure — an auditor, an acquirer running diligence, a managed service provider, a security team asked whether the vendor in its supply chain is patched — the public record stops one field short of useful.

    What to do

    Both fixes are kernel patches, not application patches, and both need an S-user to retrieve. Read SAP Note 3747649 for the Extended Passport flaw and SAP Note 3759472 for the Message Server flaw, and take the target patch level from the note rather than from any secondary summary.

    Prioritize by exposure, not by the two-tenths between the scores. For CVE-2026-44756, the affected list includes WEBDISP 9.16 through 9.20 — SAP Web Dispatcher is the reverse proxy many organizations place at the internet edge in front of an SAP landscape, which makes it the instance of this kernel most likely to be reachable by an unauthenticated attacker. Inventory Web Dispatcher separately from the ABAP and Java stacks; it is often patched on a different cadence and by a different team.

    For CVE-2026-58240, confirm which hosts can currently reach the message server’s internal port. As general practice rather than vendor instruction, that port should be reachable only from the application server subnet, and the registration ACL should be an explicit allowlist rather than a default. If reachability is broader than that today, narrowing it is worth doing while the kernel patch is being scheduled — it does not fix the validation weakness, but it shrinks the set of hosts that can attempt the registration.

    Do not treat the 10.0 as evidence of remote code execution when talking to leadership or to auditors. The honest statement is that SAP scored it 10.0, that SAP’s own description of the outcome stops at abnormal termination, that the weakness class is consistent with worse, and that no exploitation has been reported.

    Sourcing note

    Checked: the NVD API records for CVE-2026-44756 and CVE-2026-58240, and the authoritative CVE records from the CVE Program’s own API at cveawg.mitre.org for both, which agree on descriptions, vectors, CWEs, affected version lists, and the absence of any fixed version or solution field. Both records were published September 8, 2026 at 1:17 a.m. UTC, source [email protected], status “Received.”

    Could not reach: SAP’s own Security Patch Day page at support.sap.com, which is disallowed to automated fetching by its robots file, and SAP Note 3747649 at me.sap.com, which returned no readable content without a customer login. Secondary coverage of the patch day describes 19 notes in total; this page counts only the 17 SAP-CNA CVE records observed entering NVD in the September 8 batch, and does not assert a note total. Two CVEs named in secondary coverage, CVE-2026-58243 and CVE-2026-2332, were not present in that NVD window and are not described here.

    Unresolved: whether CVE-2026-44756 is exploitable beyond a denial of service. SAP’s description says termination; SAP’s vector says confidentiality, integrity, and availability with a scope change. The record does not reconcile the two, and SAP has published no exploitability statement in the public record. No exploitation of either flaw has been reported, and neither appears in CISA’s Known Exploited Vulnerabilities catalog as of this writing. NVD had not completed analysis of either record, so there is no independent score to compare against SAP’s.