SAP Patch Day March 2026: Critical NetWeaver Vulnerability with CVSS 9.1

7 min Reading Time

On March 10, 2026, SAP patched a vulnerability in the NetWeaver Enterprise Portal rated critical with a CVSS score of 9.1. CVE-2026-27685 enables arbitrary code execution via insecure deserialization in the admin interface. SAP classified the patch as “Hot News.” For the more than 400,000 SAP customers worldwide, a race against time has begun.

TL;DR

🔴 CVE-2026-27685 affects SAP NetWeaver Enterprise Portal with CVSS 9.1 (SAP Security Note, March 2026).
🏢 Over 80 percent of DAX companies and tens of thousands of mid-sized businesses use SAP NetWeaver.
⚡ Attack path involves compromised admin accounts and insiders with elevated privileges.
⚖️ Under NIS2, unpatched SAP systems pose a personal liability risk for executives.
🛡️ SAP recommends patching within 24 hours. CISA has added the vulnerability to the KEV catalog.

What Happened: CVSS 9.1 in the Heart of Enterprise IT

During the March 2026 SAP Patch Day, SAP released 18 security notes in total. The most critical among them: CVE-2026-27685, a vulnerability in the NetWeaver Enterprise Portal. The root cause is insecure deserialization in the admin interface. An attacker with compromised administrative rights can inject and execute arbitrary code.

At first glance, this may seem like a limited scenario. But the reality in many organizations is different: SAP admin accounts are frequently shared among multiple users, passwords are rarely rotated, and Privileged Access Management for SAP systems is not implemented in most mid-sized companies. A single compromised admin account is enough to take over the entire ERP landscape.

“SAP systems are the backbone of the German economy. A CVSS 9.1 vulnerability in the NetWeaver Enterprise Portal doesn’t just affect the IT department. It impacts production, procurement, finance, and HR simultaneously.”

Inprosec SAP Security Advisory, March 2026

Why This Vulnerability Is Different From Usual SAP Patches

SAP releases security notes monthly. Most affect peripheral components or require specific configurations. CVE-2026-27685 is different: The NetWeaver Enterprise Portal is the central access layer for SAP applications. Whoever compromises it gains access to everything behind it – ERP, CRM, HR, financial accounting.

Compounding the risk is the insider threat vector. Traditional perimeter security offers no protection here. The attack originates from an authenticated user with admin rights. This means firewalls and intrusion detection systems (IDS) won’t raise alarms. Only behavioral analytics or dedicated SAP security solutions like SecurityBridge or Onapsis can detect this type of attack.

SecurityWeek reports that SAP also patched critical vulnerabilities in Financial Consolidation and Quotation Management. Overall, this Patch Day clearly exceeds the average in severity.

CVSS 9.1

Critical severity rating

80%+

DAX companies use NetWeaver

24 h

SAP-recommended patch deadline

NIS2 Makes Unpatched SAP Systems a Personal Risk

Since December 2025, the NIS2 Implementation Act has been in force. Section 38 BSIG obligates executive management to personally approve risk management measures and oversee their implementation. An unpatched SAP system with a known CVSS 9.1 vulnerability is no longer just a technical oversight – it’s a personal liability risk for executives.

The NIS2 registration deadline with the BSI (Federal Office for Information Security) expired on March 6, 2026. The BSI can now initiate supervisory actions. A company that fails to patch CVE-2026-27685 promptly and falls under NIS2 provides the BSI with a concrete reason for an audit.

What IT Teams Must Do Now

Step 1: Inventory (immediately). Which SAP systems are running in your environment? Which version of the NetWeaver Enterprise Portal is in use? SAP Security Note 3XXX lists the affected versions and the fix.

Step 2: Patch prioritization (within 24 hours). SAP classifies this patch as “Hot News,” meaning highest priority – do not wait for a maintenance window. Test the patch in a sandbox and deploy it to production systems within 24 hours.

Step 3: Admin account audit (this week). How many SAP admin accounts exist? Who has access? Are passwords rotated? Are there shared accounts? The attack vector via compromised admins means your admin hygiene is now business-critical.

Step 4: SAP-specific monitoring. Standard SIEM systems do not reliably detect SAP-specific attacks. Evaluate SecurityBridge, Onapsis, or SAP Enterprise Threat Detection as supplements.

Conclusion: SAP Patches Are No Longer an IT Routine

CVE-2026-27685 is more than just another monthly patch. It’s a wake-up call for every company relying on SAP as the backbone of its business processes. The combination of CVSS 9.1 severity, insider attack vector, and NIS2 liability makes this patch a boardroom issue. Failing to act now risks not only a security incident but personal consequences for executives.

Frequently Asked Questions

We use SAP S/4HANA Cloud. Are we affected?

CVE-2026-27685 specifically affects the NetWeaver Enterprise Portal, not S/4HANA Cloud. However, many companies operate hybrid environments where on-premise NetWeaver components act as gateways to cloud services. Review your architecture: If a NetWeaver system serves as the access layer, it is vulnerable – even if the actual data resides in the cloud.

Our SAP team says the patch requires a maintenance window. How urgent is it really?

SAP classifies this patch as “Hot News” – the highest urgency level. In practice, this means: Do not wait for a regular maintenance window. Patch within 24 hours. Test the patch in a sandbox environment, then deploy it to production immediately. The alternative is running a system with a publicly known CVSS 9.1 vulnerability.

How can we detect if our SAP admin accounts have been compromised?

Standard SIEM systems typically fail to detect SAP-specific anomalies. Review SAP audit logs for unusual admin activity: logins outside business hours, bulk permission changes, new RFC connections. Dedicated solutions like SecurityBridge or Onapsis offer automated SAP threat detection. Learn how companies systematically secure their software supply chain in the SBOM practical guide.

Do we need to report this patch to the BSI?

You don’t need to report the patching itself. However, if you fall under NIS2 and fail to apply the patch promptly, the BSI may consider this a violation of risk management obligations during an audit. Document the patching process thoroughly, including timestamps and responsible parties.

Is there a workaround if we can’t patch immediately?

As a temporary measure, SAP recommends restricting admin access to the NetWeaver Enterprise Portal. Disable remote admin access, enforce multi-factor authentication (MFA) for all SAP admin accounts, and closely monitor SAP audit logs. This is not a substitute for the patch but reduces the attack surface.