CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

SAP ABAP Platform

product · product:sap-abap-platform

Coverage
2
first 2026-08-12 → last 2026-10-11
Latest activity
2026-10-10
Two critical pre-auth SAP kernel flaws (CVSS 10.0 and 9.8) reach through the ports SAP GUI and RFC need…
Peak priority
high
2 high
Targets
public-sector
sectors: public-sector, finance, manufacturing · regions: europe
Sources cited
11
7 hosts

Action items (3)

Do-now tasks recorded on the entries about SAP ABAP Platform, newest first. Check the date before acting on an older one.

  • Apply SAP Security Notes 3747649 (OVERPASS) and 3759472 (S4GET) to every SAP kernel-based system now, internet-exposed systems first and then internal ones, because the affected components are commonly reachable through internal firewalls; public proof-of-concept exploits for both flaws have been available since 2026-09-15 in the SAPMAP toolkit, and Onapsis found over 10,000 internet-facing SAP interfaces.
    2026-09-10CVE-2026-44756 +1
  • Rebuild and redeploy the fixed release from SAP Security Note 3771065 on every self-managed SAP Commerce Cloud instance, since an installed patch is not sufficient for this component; restrict the vulnerable Data Hub Adapter endpoint with a Commerce Cloud IP filter set until the redeploy, and give any instance that stayed reachable and unredeployed after 2026-08-14 a compromise assessment.
    2026-08-12CVE-2026-58231 +5
  • For any SAP Manufacturing Integration and Intelligence instance patched with Security Note 3765948 (CVE-2026-44772), configure and maintain the new 'Secure Transformer' system property with an explicit allowed-hosts list for XSL files; the patch alone does not remove the vulnerable servlet, and without this property the flaw remains exploitable regardless of patch status.
    2026-08-12CVE-2026-58231 +5

Defender insights

What each entry about SAP ABAP Platform tells a defender to do, newest first.

2026-09-10HIGHTwo critical pre-auth SAP kernel flaws (CVSS 10.0 and 9.8) reach through the ports SAP GUI and RFC need; segmentation will not close them

Exposure · triage

Story timeline

  1. 2026-09-10SAP September 2026 Patch Day: OVERPASS (CVE-2026-44756, CVSS 10.0) and S4GET (CVE-2026-58240, CVSS 9.8), two unauthenticated pre-auth RCE flaws in shared SAP kernel components reachable through ports that cannot be firewalled without breaking normal SAP GUI/RFC use
    trending-vulnerabilitiesTwo critical pre-auth SAP kernel flaws (CVSS 10.0 and 9.8) reach through the ports SAP GUI and RFC need; segmentation will not close them
  2. 2026-08-12SAP Commerce Cloud CVE-2026-58231: an unauthenticated request to a vulnerable Data Hub Adapter endpoint reaches arbitrary code execution (CVSS 10.0), and the fix needs a rebuild and redeploy
    trending-vulnerabilitiesSAP's August patch day is led by a CVSS 10.0 pre-auth code-execution flaw in the Commerce Cloud Data Hub Adapter, fixed only by a rebuild and redeploy

Hunting pivots

CVEs
CVE-2026-34265CVE-2026-42945CVE-2026-44756CVE-2026-44758CVE-2026-44772CVE-2026-58231CVE-2026-58240CVE-2026-58243
Releases covered
SAP ABAP Platform
Tags
pre-auth ×2rce ×2vulnerabilities ×2auth-bypassinfo-disclosurepatch-availablepoc-public
ATT&CK techniques (4 across 6 tactics)

4 techniques observed across 2 entries about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessValid Accounts: Default Accounts · Exploit Public-Facing Application
  • ExecutionCommand and Scripting Interpreter
  • PersistenceValid Accounts: Default Accounts
  • Privilege EscalationValid Accounts: Default Accounts
  • StealthValid Accounts: Default Accounts
  • Lateral MovementExploitation of Remote Services

Initial Access TA0001

T1078.001Valid Accounts: Default Accounts×1

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.

Evidence: 2026-08-12/sap-august-2026-cve-2026-58231-commerce-cloud-data-hub-rce · ATT&CK page ↗

T1190Exploit Public-Facing Application×2

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network. The weakness in the system can be a software bug, a temporary glitch, or a misconfiguration.

Evidence: 2026-09-10/sap-september-2026-overpass-s4get-preauth-rce · 2026-08-12/sap-august-2026-cve-2026-58231-commerce-cloud-data-hub-rce · ATT&CK page ↗

Execution TA0002

T1059Command and Scripting Interpreter×1

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell.

Evidence: 2026-08-12/sap-august-2026-cve-2026-58231-commerce-cloud-data-hub-rce · ATT&CK page ↗

Persistence TA0003

T1078.001Valid Accounts: Default Accounts×1

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.

Evidence: 2026-08-12/sap-august-2026-cve-2026-58231-commerce-cloud-data-hub-rce · ATT&CK page ↗

Privilege Escalation TA0004

T1078.001Valid Accounts: Default Accounts×1

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.

Evidence: 2026-08-12/sap-august-2026-cve-2026-58231-commerce-cloud-data-hub-rce · ATT&CK page ↗

Stealth TA0005

T1078.001Valid Accounts: Default Accounts×1

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.

Evidence: 2026-08-12/sap-august-2026-cve-2026-58231-commerce-cloud-data-hub-rce · ATT&CK page ↗

Lateral Movement TA0008

T1210Exploitation of Remote Services×1

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.

Evidence: 2026-09-10/sap-september-2026-overpass-s4get-preauth-rce · ATT&CK page ↗

Entries about SAP ABAP Platform (2)

2026-09-10 · view entry permalink →

HIGHCVE-2026-44756 +1updatedNATOB2

SAP September 2026 Patch Day: OVERPASS (CVE-2026-44756, CVSS 10.0) and S4GET (CVE-2026-58240, CVSS 9.8), two unauthenticated pre-auth RCE flaws in shared SAP kernel components reachable through ports that cannot be firewalled without breaking normal SAP GUI/RFC use

SAP's 8 September 2026 Security Patch Day fixed CVE-2026-44756 ("OVERPASS", CVSS 10.0) and CVE-2026-58240 ("S4GET", CVSS 9.8), both discovered and responsibly disclosed by Onapsis Research Labs, both remotely exploitable pre-authentication (CERT-EU, advisory 2026-011, 2026-09-09). OVERPASS is a memory-corruption flaw in the SAP kernel's processing of the Extended Passport, a tracing structure attached to requests and parsed before session authentication; because the handling code is shared, the flaw is reachable via three independent unauthenticated routes: the Internet Communication Manager/Web Dispatcher (HTTP/HTTPS, Fiori/WebGUI/APIs), the SAP Dispatcher (the SAP GUI logon protocol), and RFC connections between systems, each with a single crafted request corrupting memory to reach arbitrary OS command execution as the account that owns the SAP installation (Onapsis, 2026-09-09; CERT-EU, 2026-09-09). Onapsis's own internet-wide fingerprinting found more than 10,000 unique internet-facing IPs presenting an SAP web interface, a figure it calls conservative since it structurally undercounts the SAP Web Dispatcher, which returns no distinguishing banner (Onapsis, 2026-09-09). S4GET is a distinct logic flaw in the SAP NetWeaver Message Server (kernel lines 9.16-9.20, native to S/4HANA and S/4HANA Cloud Private Edition) reachable through the same public port every SAP GUI client connects to: a crafted packet gets an arbitrary IP address accepted as a trusted internal node, and the Message Server propagates that false trust across the cluster so the Gateway admits the attacker as internal and the attacker can invoke RFC-callable programs to reach code execution as <sid>adm on every application server: "exploitation requires no credentials, no certificate, and no pre-existing misconfiguration" (Onapsis, 2026-09-09). Because the flaw abuses the Gateway's trust-membership decision rather than its ACLs, the standard secinfo/reginfo/ms/acl_info hardening does not intercept it (Onapsis, 2026-09-09). Neither flaw is confirmed exploited as of publication, but Onapsis notes SAP patches have historically been reverse-engineered into working exploits within 72 hours, as happened with the RECON vulnerability (CVE-2020-6287), and that window keeps shrinking with AI-assisted tooling, while a comparable pre-auth SAP disclosure (CVE-2025-31324) became 2025's most-exploited CVE by Mandiant's count (Onapsis, 2026-09-09). Fixed via SAP Security Note 3747649 (OVERPASS, a single kernel patch closing all three routes, with an HTTP-only interim workaround in Note 3756304) and Note 3759472 (S4GET, kernel patch levels 9.16 PL100/9.18 PL32/9.19 PL17/9.20 PL7).

Triage: an SAP Gateway admitting a connection as internal from an IP address that is not a known application server, followed by invocations of RFC-callable programs from it, is the S4GET trust-abuse pattern Onapsis describes (Onapsis, 2026-09-09).

A targeted search using high-fidelity fingerprints identifies more than 10,000 unique Internet-facing IP addresses presenting an SAP web interface reachable from the public Internet, and that figure is conservative.

Exploitation requires no credentials, no certificate, and no pre-existing misconfiguration. A successful attack yields full remote code execution as <sid>adm, the OS-level user that runs SAP, on every application server in the cluster.

On September 15th, a group of researchers publicly released an open-source SAP discovery and exploitation toolkit

Defenders should operate under the assumption that OVERPASS exploit PoCs have been made publicly available.

Onapsis Research Labs 2026-09-09

Public code establishes that a capability is available; an incident report establishes that someone used it against a victim.

Senthorus 2026-10-06
Updaterun 2026-10-10T0255Z-intelsummarytagscvessourcesevidenceactionssourcing_notebody

Onapsis Research Labs reports that on 2026-09-15 a group of researchers publicly released SAPMAP, an open-source (GPL 3.0) SAP discovery and exploitation toolkit that contains proof-of-concept exploits for both flaws, alongside ten standalone pre-authentication exploit files, post-authentication modules including an SAP ransomware proof of concept, and an automation loop that chains scanning, exploitation, enrichment and propagation (Onapsis, 2026-09-18). The maintainers first indicated that the OVERPASS exploits were being withheld, but Onapsis found them in the repository commits, says every clone since the original publication includes them and tells defenders to assume the OVERPASS proofs of concept are public (Onapsis, 2026-09-18). Onapsis had not observed threat actors using the toolkit when it wrote, and notes that public proof-of-concept releases can often jumpstart attack campaigns within days or weeks (Onapsis, 2026-09-18). Senthorus assesses on 2026-10-06 that packaging the capabilities together could reduce the preparation an intrusion needs, and separates that from evidence of use, which would need incident reporting (Senthorus, 2026-10-06). No source read reports exploitation of either flaw, and the fixes are unchanged: SAP Security Notes 3747649 and 3759472.

Correctionrun 2026-10-11T1307Z-auditheadlinebody

OVERPASS (CVE-2026-44756) is not limited to the 9.16 to 9.20 kernel lines: CERT-EU lists KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04 and 9.16 to 9.20, the 7.22 kernels (unicode and non-unicode), the 7.53 and 8.04 unicode kernels, and Web Dispatcher 9.16 to 9.20 as affected (CERT-EU, 2026-09-09). The earlier Exposure line described only S4GET's scope, so systems on older kernels, classic ABAP and ECC included, need the OVERPASS kernel patch as well.

vulnerability10 Sep 04:40Zmulti-sourceOpen finding →
Sources: Onapsis Research Labs · CERT-EU · BleepingComputer · Senthorus

2026-08-12 · view entry permalink →

HIGHCVE-2026-58231 +5updatedNATOA1

SAP Commerce Cloud CVE-2026-58231: an unauthenticated request to a vulnerable Data Hub Adapter endpoint reaches arbitrary code execution (CVSS 10.0), and the fix needs a rebuild and redeploy

SAP's August 2026 Security Patch Day of 2026-08-11 released 28 new security notes plus one GitHub security advisory, with two updates to previously released notes (SAP SE, 2026-08-11); Onapsis, counting the cycle its own way, puts it at thirty-three notes including five HotNews and nine High Priority (Onapsis Research Labs, 2026-08-11). The one that changes an exposure picture rather than a patch schedule is CVE-2026-58231, carried by SAP Security Note 3771065 at CVSS 10.0: an improper-authorization flaw in the Data Hub Adapter of SAP Commerce Cloud. Onapsis, which worked with SAP on eleven of the notes in this cycle, describes the cause as insufficient authorization checks combined with insufficient input validation, and the outcome as arbitrary code execution with compromise of internal components (Onapsis Research Labs, 2026-08-11). The reason this ranks above a routine critical: Commerce Cloud runs online stores, so in analyst judgement the vulnerable component is likely to be reachable from the internet, and the score's pre-auth, no-interaction profile means reaching it takes a crafted request rather than a foothold.

Remediation for this one is not a patch install. Onapsis states customers must patch to the fixed Commerce Cloud release levels referenced in the note and then rebuild and redeploy the updated version, and that the interim exposure reduction available today is an IP filter set restricting access to the vulnerable endpoint (Onapsis Research Labs, 2026-08-11). Any organisation whose change process treats "SAP note applied" as equivalent to "fixed" will record this as remediated while the storefront is still reachable. SAP Security Note 3773203 is SAP's fix for CVE-2026-42945 (CVSS 8.1) as a potential buffer overflow affecting Commerce Cloud public-cloud deployments with NGINX (SAP SE, 2026-08-11), and it is consumed the same way, by building and deploying the Commerce Cloud application (Onapsis, 2026-08-11).

Further notes Onapsis classes as HotNews matter to different estates. CVE-2026-44772 (CVSS 9.9, Note 3765948) and CVE-2026-44758 (CVSS 9.1, Note 3758900) are code-injection flaws in SAP Manufacturing Integration and Intelligence reaching arbitrary command execution on the underlying host; Onapsis states the lower score on the second reflects a higher privilege requirement. The two remedies are not the same: for Note 3758900 (CVE-2026-44758) the patch removes the vulnerable servlet component outright, while for Note 3765948 (CVE-2026-44772) the servlet stays in place and customers must additionally configure and maintain a new "Secure Transformer" system property naming the hosts allowed to serve XSL files to it (Onapsis Research Labs, 2026-08-11). CVE-2026-34265 (CVSS 9.8, Note 3714806) is, in analyst judgement, the one to weigh against internal network exposure rather than internet exposure. Onapsis describes it: "Logical errors in DIAG protocol parsing allow an unauthenticated attacker to generate memory corruptions" in the Application Server ABAP kernel, with potential disclosure of sensitive system information or a crash of the instance (Onapsis Research Labs, 2026-08-11). The affected kernel list spans KRNL64NUC/KRNL64UC and KERNEL builds from 7.22 through 9.19 (SAP SE, 2026-08-11); since DIAG is the SAP GUI presentation protocol, the affected listener is, in analyst judgement, one that ordinarily faces user workstations. Rounding out the High Priority set, CVE-2026-58243 (CVSS 8.8, Note 3772411) covers the SQL Console in SAP ABAP Developer Tools, where support for host expressions inside SQL statements let a low-privileged authenticated user run database operations they should not reach (Onapsis Research Labs, 2026-08-11).

On patch day NCSC-CH rated the exploitation status unknown (NCSC-CH, 2026-08-11); three days later Defused reported exploitation attempts against the Data Hub Adapter flaw at its honeypots (BleepingComputer, 2026-08-14), and on 2026-08-15 NCSC-NL relayed Defused's report of attackers actively scanning for vulnerable systems (NCSC-NL, 2026-08-15). The Data Hub Adapter flaw demands action ahead of the normal SAP patch cadence: it is an unauthenticated, no-interaction path to code execution, disclosed with a CVSS 10.0 and a documented interim network control. Detection concepts are ordinary but specific: in web and reverse-proxy access logs, surface requests to the Data Hub Adapter endpoint from source addresses outside the integration ranges that legitimately feed it, and treat any such request that precedes an unexplained child process under the Commerce Cloud application account as an incident rather than an anomaly. In analyst judgement, legitimate Data Hub imports come from a known set of integration sources, so the source address and the calling identity, not the request body, are the useful filter. On the ABAP side, Onapsis names a crash of the instance among the possible outcomes (Onapsis Research Labs, 2026-08-11); in analyst judgement, a DIAG-parsing memory-corruption attempt would therefore surface as work-process crashes or short dumps clustered on one instance rather than as an authentication event.

Logical errors in DIAG protocol parsing allow an unauthenticated attacker to generate memory corruptions.

As a temporary workaround, customers can reduce their exposure by configuring an IP Filter Set in SAP Commerce Cloud to restrict access to the vulnerable endpoint.

Onapsis Research Labs 2026-08-11

First exploitation attempts against CVE-2026-58231 (unauth RCE in SAP Commerce Cloud, CVSS 10.0) is now hitting our honeypots - 3 days after patch day,

Defused, quoted by BleepingComputer

Security firm Defused reports that malicious actors are actively scanning and searching for vulnerable Data Hub Adapter systems. (translated from Dutch)

NCSC-NL

SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation

SAP, quoted by BleepingComputer
Updaterun 2026-08-16T0411Z-intelactionscvesevidencesourcestagstechniquesbody

The Commerce Cloud flaw, which carried no reported exploitation at the 2026-08-11 patch day, is being attacked. Threat-intelligence firm Defused reported on 2026-08-14 that the first exploitation attempts against CVE-2026-58231 were arriving at its honeypot sensors three days after SAP's 2026-08-11 patch day, and stated in the same report that the vulnerability has no public proof-of-concept (BleepingComputer, 2026-08-14). Those two facts together are the operationally interesting part: in analyst judgement, whoever is sending these requests developed exploitation attempts without published research to copy, on a three-day clock, against a component whose remediation is slower than a patch install. On 2026-08-15 the Dutch national cyber security centre published advisory NCSC-2026-0302, which records that attackers are actively scanning for and seeking out vulnerable Data Hub Adapter systems (NCSC-NL, 2026-08-15).

The mechanism is worth restating precisely because it shapes what an exposed request looks like: SAP describes the flaw as allowing an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to functions that lack sufficient validation, reaching arbitrary code execution (BleepingComputer, 2026-08-14). The exposure is real rather than theoretical: Shadowserver tracks over 4,200 IP addresses carrying a SAP Commerce Cloud fingerprint, most of them in Europe and North America, though the same reporting is explicit that it cannot say how many of those are honeypots or already remediated (BleepingComputer, 2026-08-14).

Calibrate the status honestly. What is confirmed is exploitation attempts against sensors (BleepingComputer, 2026-08-14) and scanning for vulnerable systems (NCSC-NL, 2026-08-15); no party reports a compromised production instance, and SAP has not flagged the flaw as exploited in its own advisory (BleepingComputer, 2026-08-14). That distinction matters for triage effort, not for patch priority: exploitation attempts appeared within days of a public fix on this component, and the remediation is a rebuild-and-redeploy cycle measured in change windows.

Detection, in vendor-neutral terms: in web-access and application logs for the Data Hub Adapter, look for unauthenticated requests to the adapter's functions that present the default authentication client rather than a customer-provisioned one, and, in analyst judgement, for adapter activity that no scheduled integration run accounts for. Pair that with egress review from the Commerce Cloud application tier, since arbitrary code execution there runs inside the storefront's own host. Hardening remains the vendor's own path: Onapsis, which works with SAP on its patch cycle, records that customers must patch to the fixed Commerce Cloud release levels referenced in the note and then re-build and re-deploy the updated version, and that configuring an IP Filter Set in Commerce Cloud to restrict access to the vulnerable endpoint is the temporary workaround that reduces exposure meanwhile (Onapsis, 2026-08-11).

Correctionrun 2026-08-28T0409Z-intelcvesbody

The entry stated that SAP's fix "removes the vulnerable servlet component in both cases" for CVE-2026-44772 (Note 3765948) and CVE-2026-44758 (Note 3758900). Onapsis's own text supports that statement for only one of the two. For Note 3758900 the patch does remove the vulnerable servlet component outright (Onapsis Research Labs, 2026-08-11). For Note 3765948 (CVE-2026-44772, CVSS 9.9) the servlet stays in place, and Onapsis states the required remedy directly: "After implementing the patch, customers need to maintain the new system property 'Secure Transformer' with a list of allowed hosts for hosting XSL files. Only XSL files from these hosts can be consumed by the vulnerable servlet" (Onapsis Research Labs, 2026-08-11).

The practical consequence: an SAP Basis team that applied Note 3765948 and recorded the CVSS 9.9 flaw as remediated, without configuring the Secure Transformer allowed-hosts property, has left the vulnerable servlet reachable; the patch alone does not close the flaw for this note. Teams that patched CVE-2026-44772 should verify the Secure Transformer property is now configured with an explicit allowed-hosts list, not merely that Note 3765948 shows as applied. Nothing about Note 3758900 (CVE-2026-44758) or any other flaw in this entry changes.

Correctionrun 2026-10-11T1307Z-auditsummaryreferencesbodyevidenceactionstitlecvestags

SAP Security Note 3773203 addresses CVE-2026-42945 in Commerce Cloud public-cloud deployments with NGINX (SAP SE, 2026-08-11); Onapsis states that the fix reaches customers when they build and deploy their Commerce Cloud applications (Onapsis, 2026-08-11). No cited source calls the vulnerable endpoint an import endpoint; SAP describes crafted input to functions that lack sufficient validation (BleepingComputer, 2026-08-14), and Onapsis names the vulnerable endpoint without naming its function (Onapsis Research Labs, 2026-08-11). On patch day NCSC-CH rated the exploitation status unknown (NCSC-CH, 2026-08-11). The status of CVE-2026-58231 no longer reads exploited: what is reported is exploitation attempts against Defused's honeypots and no compromised production instance (BleepingComputer, 2026-08-14), plus Defused's report of active scanning, which NCSC-NL relays (NCSC-NL, 2026-08-15).

Builds on: CVE-2026-42945, NGINX Open Source / Plus / F5 WAF products: 18-year-old heap buffer overflow in…

vulnerability12 Aug 04:45Zmulti-sourceOpen finding →
Sources: SAP SE (Security Patch Day) · Onapsis Research Labs · NCSC Switzerland, Cyber Security Hub · NCSC-NL (Nationaal Cyber Security Centrum) · BleepingComputer

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns2

Source distribution

  • onapsis.com4 (36%)
  • bleepingcomputer.com2 (18%)
  • advisories.ncsc.nl1 (9%)
  • blog.senthorus.ch1 (9%)
  • cert.europa.eu1 (9%)
  • security-hub.ncsc.admin.ch1 (9%)
  • support.sap.com1 (9%)
All cited sources (11)