November SAP Security Patch Day fixes 38 CVEs, including nine Critical SAP NetWeaver, Web Dispatcher and Gateway flaws rated up to CVSS 10.0.
#SAP #SAPSecurity #PatchDay #SAPNetWeaver #CVE2026120017 #ERPSecurity #CyberSecurity #InfoSec
#SAP #SAPSecurity #PatchDay #SAPNetWeaver #CVE2026120017 #ERPSecurity #CyberSecurity #InfoSec
SAP Security Patch Day Fixes Nine Critical Flaws in November 2026
TL;DR SAP published 38 new CVE records on November 10, 2026, as part of its November SAP Security Patch Day. Nine of them are rated Critical, and four carry the maximum CVSS score of 10.0. Most of the worst bugs affect SAP NetWeaver, SAP Web Dispatcher and SAP Gateway. November's release fixes 9 Critical, 15 High, 13 Medium and 1 Low severity flaws across 34 SAP Notes.
securityonline.info
November 10, 2026 at 1:56 AM
November SAP Security Patch Day fixes 38 CVEs, including nine Critical SAP NetWeaver, Web Dispatcher and Gateway flaws rated up to CVSS 10.0.
#SAP #SAPSecurity #PatchDay #SAPNetWeaver #CVE2026120017 #ERPSecurity #CyberSecurity #InfoSec
#SAP #SAPSecurity #PatchDay #SAPNetWeaver #CVE2026120017 #ERPSecurity #CyberSecurity #InfoSec
SAP Security Patch Day October 2026 fixes four critical vulnerabilities, including a CVSS 10.0 Cloud SDK flaw and 9.9 bugs in Visual Composer and S/4HANA.
#SAP #SAPPatchDay #CVE202689111 #CVE202689110 #CVE202689107 #CriticalVulnerabilities #ERPSecurity #CyberSecurity
#SAP #SAPPatchDay #CVE202689111 #CVE202689110 #CVE202689107 #CriticalVulnerabilities #ERPSecurity #CyberSecurity
SAP Security Patch Day October 2026 Fixes CVSS 10 Cloud SDK Flaw and Three More Critical Bugs
TL;DR SAP Security Patch Day for October 2026 addressed 20 CVEs on October 13. Four of them are critical vulnerabilities, led by a CVSS 10.0 flaw in the SAP Cloud SDK for Python. Two more critical bugs in NetWeaver Visual Composer and S/4HANA score 9.9. Why It Matters SAP systems run finance, supply chain and HR for many of the world's largest firms.
securityonline.info
October 13, 2026 at 3:04 AM
SAP Security Patch Day October 2026 fixes four critical vulnerabilities, including a CVSS 10.0 Cloud SDK flaw and 9.9 bugs in Visual Composer and S/4HANA.
#SAP #SAPPatchDay #CVE202689111 #CVE202689110 #CVE202689107 #CriticalVulnerabilities #ERPSecurity #CyberSecurity
#SAP #SAPPatchDay #CVE202689111 #CVE202689110 #CVE202689107 #CriticalVulnerabilities #ERPSecurity #CyberSecurity
PROG MIS ERP App hit by CRITICAL vuln (CVE-2026-14807): hard-coded creds let attackers access code & DB. No patch — restrict access, monitor ERP activity. 🚨 https://radar.offseq.com/threat/cve-2026-14807-cwe-798-use-of-hard-coded-credentia-f736ee8ed603a6fe #OffSeq #CVE202614807 #ERPsecurity
CVE-2026-14807: CWE-798 Use of Hard-coded Credentials in PROG MIS ERP App
CVE-2026-14807 identifies a Use of Hard-coded Credentials vulnerability (CWE-798) in the PROG MIS ERP App. This security weakness permits unauthenticated remote attackers to bypass authentication controls by leveraging embedded credentials
radar.offseq.com
July 6, 2026 at 9:00 AM
PROG MIS ERP App hit by CRITICAL vuln (CVE-2026-14807): hard-coded creds let attackers access code & DB. No patch — restrict access, monitor ERP activity. 🚨 https://radar.offseq.com/threat/cve-2026-14807-cwe-798-use-of-hard-coded-credentia-f736ee8ed603a6fe #OffSeq #CVE202614807 #ERPsecurity
Devs Palace ERP Online 4.0 hit by MEDIUM XSS (CVE-2026-8253) in /inventory/purchase_save. No patch — use WAF rules & restrict privileged access. Monitor for updates: https://radar.offseq.com/threat/cve-2026-8253-cross-site-scripting-in-devs-palace--7f918dea #OffSeq #XSS #ERPSecurity
CVE-2026-8253: Cross Site Scripting in Devs Palace ERP Online
This vulnerability in Devs Palace ERP Online up to version 4.0.0 involves a cross-site scripting issue in an unspecified functionality within the /inventory/purchase_save endpoint. The vulnerability can be triggered remotely without user in
radar.offseq.com
May 11, 2026 at 12:00 AM
Devs Palace ERP Online 4.0 hit by MEDIUM XSS (CVE-2026-8253) in /inventory/purchase_save. No patch — use WAF rules & restrict privileged access. Monitor for updates: https://radar.offseq.com/threat/cve-2026-8253-cross-site-scripting-in-devs-palace--7f918dea #OffSeq #XSS #ERPSecurity
Barts Health NHS faces a HIGH severity Cl0p ransomware breach targeting Oracle EBS—patient data & operations at risk. Act fast: patch, deploy EDR, strengthen access controls. https://radar.offseq.com/threat/barts-health-nhs-confirms-oracle-ebs-linked-data-b-9ae7682b #OffSeq #Ransomware #ERPsecurity
December 7, 2025 at 4:02 AM
Barts Health NHS faces a HIGH severity Cl0p ransomware breach targeting Oracle EBS—patient data & operations at risk. Act fast: patch, deploy EDR, strengthen access controls. https://radar.offseq.com/threat/barts-health-nhs-confirms-oracle-ebs-linked-data-b-9ae7682b #OffSeq #Ransomware #ERPsecurity
HIGH severity: Tryton trytond (6.0–7.5) has an auth flaw on the HTML editor route. Upgrade to a fixed release or restrict access. Protect sensitive ERP data! https://radar.offseq.com/threat/cve-2025-66423-cwe-863-incorrect-authorization-in--5b710efe #OffSeq #Tryton #ERPsecurity
November 30, 2025 at 4:34 AM
HIGH severity: Tryton trytond (6.0–7.5) has an auth flaw on the HTML editor route. Upgrade to a fixed release or restrict access. Protect sensitive ERP data! https://radar.offseq.com/threat/cve-2025-66423-cwe-863-incorrect-authorization-in--5b710efe #OffSeq #Tryton #ERPsecurity
Cox Enterprises faces a HIGH severity breach in Oracle E-Business Suite. Sensitive data at risk—review access controls and enhance monitoring now. No known exploits, but vigilance is key. https://radar.offseq.com/threat/cox-enterprises-discloses-oracle-e-business-suite--bf811ba0 #OffSeq #ERPsecurity
November 23, 2025 at 3:02 AM
Cox Enterprises faces a HIGH severity breach in Oracle E-Business Suite. Sensitive data at risk—review access controls and enhance monitoring now. No known exploits, but vigilance is key. https://radar.offseq.com/threat/cox-enterprises-discloses-oracle-e-business-suite--bf811ba0 #OffSeq #ERPsecurity
CRITICAL: Netty ERP <1.1000 hit by SQL Injection (CVE-2025-11253). Remote attackers can exploit without login. Patch urgently, restrict access, monitor for suspicious SQL. https://radar.offseq.com/threat/cve-2025-11253-cwe-89-improper-neutralization-of-s-697280a6 #OffSeq #SQLInjection #ERPsecurity
October 24, 2025 at 9:03 AM
CRITICAL: Netty ERP <1.1000 hit by SQL Injection (CVE-2025-11253). Remote attackers can exploit without login. Patch urgently, restrict access, monitor for suspicious SQL. https://radar.offseq.com/threat/cve-2025-11253-cwe-89-improper-neutralization-of-s-697280a6 #OffSeq #SQLInjection #ERPsecurity
⚠️ Why this matters:
This flaw affects SAP Financials (General Ledger). Exploitation can lead to manipulation of accounting data, loss of integrity, and serious compliance risks.
CVSS: 9.9 (CRITICAL)
#ERPsecurity #FinancialSystems #CyberRisk
This flaw affects SAP Financials (General Ledger). Exploitation can lead to manipulation of accounting data, loss of integrity, and serious compliance risks.
CVSS: 9.9 (CRITICAL)
#ERPsecurity #FinancialSystems #CyberRisk
January 13, 2026 at 8:52 AM
⚠️ Why this matters:
This flaw affects SAP Financials (General Ledger). Exploitation can lead to manipulation of accounting data, loss of integrity, and serious compliance risks.
CVSS: 9.9 (CRITICAL)
#ERPsecurity #FinancialSystems #CyberRisk
This flaw affects SAP Financials (General Ledger). Exploitation can lead to manipulation of accounting data, loss of integrity, and serious compliance risks.
CVSS: 9.9 (CRITICAL)
#ERPsecurity #FinancialSystems #CyberRisk