【資安漏洞預警】SAP針對旗下多款產品發布重大資安公告

【行政公告】

公告單位	圖資處網路系統組
訊息類別	行政公告行政公告	公告對象	全體
公告主題	【資安漏洞預警】SAP針對旗下多款產品發布重大資安公告【Security Vulnerability Alert】SAP has issued a critical security advisory for multiple products
公告內容	轉發台灣電腦網路危機處理暨協調中心資安訊息警訊 TWCERTCC-200-202609-00000019 [內容說明] SAP發布九月份例行更新，共修補20項漏洞，其中4項屬於高風險資安漏洞(CVE-2026-44756，CVSS：10.0、CVE-2026-58240，CVSS：9.8、CVE-2026-76969，CVSS：9.4和CVE-2026-66768，CVSS：9.0)。 CVE-2026-44756，Extended Passport Protocol (EPP)處理庫中存在記憶體安全漏洞，在特定條件下，未經身分驗證的攻擊者可利用特製的網路請求，導致程式出現未定義行為並異常終止。 CVE-2026-58240，SAP NetWeaver Message Server 在註冊過程中對內部應用伺服器元件的真實性驗證不足，未經身分驗證的攻擊者若有網路存取權限，可能在應用環境中執行未經授權的操作。 CVE-2026-76969，@sap/cds-mtxs NPM library 對啟用可擴展性的multitenant CAP 應用中使用的某些功能未進行充分檢查，未經身分驗證的攻擊者可利用特製的請求獲取敏感憑證。 CVE-2026-66768，SAP GUI for Java 對某些從連接的後端系統呼叫函數未能正確執行信任等級策略，低權限的攻擊者可利用此漏洞，透過操縱連接的後端系統導致在受害者機器上執行任意命令。 [影響平台] SAP Extended Passport (EPP) Processing KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, WEBDISP 9.16, 9.18, 9.19, 9.20, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.16, 9.18, 9.19, 9.20 版本 SAP NetWeaver (Message Server) KERNEL 9.16, 9.18, 9.19, 9.20 版本 sap/cds-mtxs 特定版本 SAP NetWeaver (SAP GUI for Java) BC-FES-JAV 8.10 版本 [建議措施] 根據官方網站釋出的解決方式進行修補 https://support.sap.com/en/my-support/knowledge-base/security-notes-news/september-2026.html?isu_page=1 [參考資料] 1. https://www.twcert.org.tw/tw/cp-169-11207-b9e4b-1.html Forwarded from Taiwan Computer Emergency Response Team / Coordination Center Security Information Alert TWCERTCC-200-202609-00000019 [Content Description] SAP released its September regular updates, patching a total of 20 vulnerabilities, of which 4 are high-risk security vulnerabilities (CVE-2026-44756, CVSS：10.0, CVE-2026-58240, CVSS：9.8, CVE-2026-76969, CVSS：9.4 and CVE-2026-66768, CVSS：9.0). CVE-2026-44756, a memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditions, an unauthenticated attacker can exploit specially crafted network requests, causing undefined behavior and abnormal termination of the program. CVE-2026-58240, SAP NetWeaver Message Server has insufficient authenticity verification of internal application server components during the registration process. An unauthenticated attacker with network access may perform unauthorized operations in the application environment. CVE-2026-76969, the @sap/cds-mtxs NPM library does not adequately check certain functions used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker can exploit specially crafted requests to obtain sensitive credentials. CVE-2026-66768, SAP GUI for Java fails to properly enforce trust-level policies for certain function calls from connected backend systems. A low-privileged attacker can exploit this vulnerability to cause arbitrary commands to be executed on the victim's machine by manipulating the connected backend system. [Affected Platforms] SAP Extended Passport (EPP) Processing KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, WEBDISP 9.16, 9.18, 9.19, 9.20, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.16, 9.18, 9.19, 9.20 versions SAP NetWeaver (Message Server) KERNEL 9.16, 9.18, 9.19, 9.20 versions Specific versions of sap/cds-mtxs SAP NetWeaver (SAP GUI for Java) BC-FES-JAV 8.10 version [Recommended Measures] Apply patches according to the solution released on the official website https://support.sap.com/en/my-support/knowledge-base/security-notes-news/september-2026.html?isu_page=1 [References] 1. https://www.twcert.org.tw/tw/cp-169-11207-b9e4b-1.html
相關訊息	官方網站參考資料
公告時間	2026/9/24 至 2027/3/24	點閱次數	334