SAP October Security Patch Day Shows How Business Roles Can Become Attack Paths

October’s SAP Security Patch Day tests what permissions, severity scores, and completed patches can tell a company about its security risk.

Vulnerabilities in business functions and administrative tools could give attackers authority far beyond their initial permissions, while a lower-rated flaw threatens services without requiring authentication. Those weaknesses show why access restrictions and severity scores alone cannot determine remediation priorities.

The wider lesson comes from September’s SAP OVERPASS vulnerability. In the weeks following September Patch Day, researchers identified another attack route, and exploit code became publicly available. Both developments changed the exposure picture after SAP had released its correction. Security teams must account for new information about known vulnerabilities, sometimes before organizations have completed remediation.

When Limited SAP Access Becomes System-Level Control

Three of October’s critical vulnerabilities expose a problem that conventional access reviews may not detect. Users can have legitimate permissions, yet application weaknesses can give them far greater control than intended.

Thomas Fritsch, SAP security researcher at Onapsis, reports that the company’s research labs discovered two of the three critical vulnerabilities.

In SAP NetWeaver Visual Composer (CVSS 9.9), users with limited privileges could invoke operations on a preconfigured backend system, potentially compromising it. Meanwhile, SAP Manufacturing Integration and Intelligence (MII) has a flaw (CVSS 9.1) that could allow administrators to create accounts with elevated privileges on the underlying Java application server and compromise the system.

The weakness in SAP S/4HANA (CVSS 9.9) reaches core business functionality. Jonathan Stross of Pathlock notes that the attack requires only a specific rule-management business role, with no need for system-administrator rights. Insufficient input validation could let that user execute arbitrary ABAP code and compromise the entire system.

The common problem is that legitimate permissions can expose users to vulnerable functions with consequences beyond their intended access.

Why Patch Severity Doesn’t Tell the Whole Remediation Story

October’s HTTP/2 vulnerability in SAP NetWeaver and Web Dispatcher (CVSS 7.5) presents a different risk. Attackers need no credentials to crash affected processes, potentially disrupting access to SAP applications. However, only systems with HTTP/2 enabled and accessible to attackers are exposed.

Stross warns that the vulnerability deserves urgent attention where affected services are accessible from untrusted networks, despite its lower CVSS score.

Layer Seven Security explains that disabling HTTP/2 can temporarily reduce exposure, but permanent remediation requires the appropriate kernel or product patches. Its analysis also identifies a separate tradeoff in SAP Commerce Cloud, where a SQL injection flaw (CVSS 8.8) can be temporarily mitigated by disabling the vulnerable parameter, at the cost of the associated sorting functionality.

Other vulnerabilities require additional steps to complete remediation. Gert-Jan Koster, SAP security specialist at SecurityBridge, identifies four medium-severity notes requiring manual activity beyond patch installation. The Visual Composer workaround also requires an application restart, while MII has no documented workaround.

These differences complicate patch planning. Some vulnerabilities require software updates, others need configuration changes or redeployment, and temporary measures may affect business functionality.

How SAP OVERPASS Shows That Security Risks Can Change After Patch Day

October’s new vulnerabilities are only part of the security picture.

SAP OVERPASS (CVSS 10.0), a critical SAP Kernel vulnerability discovered by Onapsis Research Labs and patched by SAP on September 8, shows how the risks surrounding an earlier flaw can continue changing after Patch Day. The developments show why security teams must continue reassessing earlier vulnerabilities while addressing new disclosures.

Layer Seven Security reported that OVERPASS could be exploited through web traffic, SAP GUI, and traditional RFC connections. Subsequent research identified an additional attack route through Next Generation RFC (NGRFC), which carries SAP communications over HTTPS. Existing restrictions on traditional RFC traffic may not block this route, while SAP’s temporary Web Dispatcher workaround covers only certain web communications.

On September 15, independent security researchers released SAPMAP, an open-source toolkit for testing and exploiting security weaknesses in SAP systems. Juan Pablo Perez-Etchegoyen, CTO of Onapsis, warned that it includes proof-of-concept exploits for recently patched SAP vulnerabilities and ransomware functionality targeting critical business tables. He cautioned that attackers could use these capabilities to steal or manipulate business data, disrupt operations, and move between connected SAP systems.

A patch may be available while researchers continue uncovering new attack paths and others develop tools to exploit the weakness. For organizations managing October’s disclosures, that means previously identified vulnerabilities may require renewed attention as new evidence changes the risks they pose.

What This Means for SAPinsiders

Access permissions need closer scrutiny. Security teams should examine the technical capabilities available through sensitive business roles, not just the permissions assigned to them. This could identify risks that conventional access certification misses.

Remediation priorities should reflect business dependencies. A vulnerability affecting a shared service may disrupt several business processes at once. Understanding which operations depend on exposed components can help organizations prioritize corrections and coordinate downtime.

Evolving threats require regular reassessment. Decisions to delay patches rely on the attack methods and protections known at the time. New research should prompt organizations to revisit those decisions before exposure becomes harder to contain.