Onapsis Research Labs
onapsis · B · active
SAP-security specialist research lab; authoritative public transcription of the monthly SAP Security Patch Day (per-CVE CVSS/CWE/SAP-Note detail behind SAP's login-gated notes). Added as candidate 2026-07-14 after serving as the primary for the July 2026 SAP Patch Day entry (CVE-2026-44747/-27690/-44761). FETCH -> webfetch https://onapsis.com/blog/sap-security-patch-day-<month>-<year>/ on SAP patch days. | 2026-07-26 weekly quality audit: promoted candidate → active on the documented lifecycle bar (cited by published entries from 4 distinct runs; the bar is 3). The promotion had never been executed because nothing counted contributing runs, the digest now emits sources.promotion_due (tools/run_summary.py).
Cited in 7 entries
Citation cadence
Citation days per ISO week (18 weeks of coverage span, total 5).
- SAP September 2026 Patch Day: OVERPASS (CVE-2026-44756, CVSS 10.0) and S4GET (CVE-2026-58240, CVSS 9.8), two unauthenticated pre-auth RCE flaws in shared SAP kernel components reachable through ports that cannot be firewalled without breaking normal SAP GUI/RFC use2026-09-10
- CVE-2026-58231, SAP Commerce Cloud: an unauthenticated request to the Data Hub Adapter import endpoint reaches arbitrary code execution (CVSS 10.0), and the fix needs a rebuild and redeploy2026-08-12
- SAP July 2026 Security Patch Day: three CVSS ≥9.1 flaws in NetWeaver AS ABAP, Approuter and Commerce Cloud, two reachable without authentication2026-07-14
- CVE-2026-47344 et al. TYPO3 core June release: 13 CVEs across every supported branch (10.4 ELTS → 14.3 LTS)2026-06-10
- CVE-2026-44748, SAP June Patch Day: SAML XML Signature Wrapping in NetWeaver AS ABAP (CVSS 9.9) plus an unauth RFC kernel memory-corruption (CVSS 9.8)2026-06-10
- CVE-2026-34263 / CVE-2026-34260, SAP Commerce Cloud pre-auth RCE, S/4HANA Enterprise Search SQL injection2026-05-13
- CERTFR-2026-AVI-0572, Centreon Infra Monitoring: RCE / SQLi / XSS cluster (April 2026 bulletin)2026-05-13