SAP Patch Day March 2026: Critical NetWeaver Flaw CVSS 9.1

7 Min. Reading Time

SAP patched a critical vulnerability in its NetWeaver Enterprise Portal on March 10, 2026, with a CVSS score of 9.1. CVE-2026-27685 enables arbitrary code execution through insecure deserialization in the Admin-Interface. SAP classified this patch as “Hot News.” Over 400,000 SAP customers worldwide are now racing against the clock to apply it.

Key Takeaways

🔴 CVE-2026-27685 affects SAP NetWeaver Enterprise Portal with a CVSS score of 9.1 (SAP Security Note, March 2026).
🏢 Over 80 percent of DAX companies and thousands of medium-sized enterprises rely on SAP NetWeaver.
⚡ The attack vector involves compromised Admin-Accounts and insiders with elevated privileges.
⚖️ Unpatched SAP systems have been a personal liability for executives since NIS2.
🛡️ SAP recommends patching within 24 hours. CISA has added the vulnerability to its KEV catalog.

What Happened: CVSS 9.1 in the Heart of Enterprise IT

On March 10, 2026, SAP’s Patch Day, the company released a total of 18 security notes. The most critical of these was CVE-2026-27685, a vulnerability in the NetWeaver Enterprise Portal. The root cause is insecure deserialization in the Admin-Interface. An attacker with compromised administrator credentials can inject and execute arbitrary code.

This might initially seem like a limited scenario. However, the reality in many enterprises is different: SAP Admin-Accounts are often shared by multiple people, passwords are rarely rotated, and Privileged Access Management for SAP systems is not implemented in most medium-sized enterprises. A compromised Admin-Account is enough to take over the entire ERP landscape.

“SAP systems are the backbone of the German economy. A CVSS 9.1 vulnerability in the NetWeaver Enterprise Portal affects not only the IT department but also production, procurement, finance, and human resources simultaneously.”

Inprosec SAP Security Advisory, March 2026

Why this vulnerability is different from typical SAP patches

SAP publishes monthly security notes. Most of these affect edge cases or require specific configurations. CVE-2026-27685 is different: The NetWeaver Enterprise Portal is the central access layer for SAP applications. Compromising this gives access to everything behind it, including ERP, CRM, HR, and financial accounting systems.

Additionally, the insider threat vector comes into play. Traditional perimeter security measures are ineffective here. The attack originates from an authenticated user with admin rights, meaning neither the firewall nor IDS will trigger an alert. Only behavioral analytics or dedicated SAP security solutions like SecurityBridge or Onapsis can detect this attack type.

SecurityWeek reports that SAP has also patched critical vulnerabilities in Financial Consolidation and Quotation Management. Overall, this is a patch day that significantly exceeds the average.

CVSS 9.1

Critical severity

80 %+

Over 80% of DAX-listed companies use NetWeaver

24 h

SAP-recommended patch deadline

NIS2 makes unpatched SAP systems a personal liability

Since December 2025, the NIS2 implementation law has been in effect. Paragraph 38 of the BSIG requires business leaders to personally approve and monitor risk management measures. An unpatched SAP system with a known CVSS 9.1 vulnerability is no longer a technical oversight; it is a personal liability for the CEO and other executives.

The NIS2 registration deadline with the BSI expired on March 6, 2026. The BSI can now initiate oversight measures immediately. A company that does not patch CVE-2026-27685 promptly and is also subject to NIS2 provides the BSI with a concrete reason for an investigation.

What IT teams need to do now

Step 1: Inventory (immediate). Which SAP systems are running in your environment? What version of the NetWeaver Enterprise Portal is in use? The SAP Security Note 3XXX lists the affected versions and the fix.

Step 2: Patch prioritization (24 hours). SAP categorizes this patch as “Hot News,” meaning highest priority. Do not wait for a maintenance window. Test the patch in a sandbox and roll it out to production systems within 24 hours.

Step 3: Admin account audit (this week). How many SAP admin accounts are there? Who has access? Are passwords rotated? The attack vector through compromised admins means that your admin hygiene is now a business-critical issue.

Step 4: SAP-specific monitoring. Standard SIEM solutions do not reliably detect SAP-specific attacks. Consider evaluating SecurityBridge, Onapsis, or SAP Enterprise Threat Detection as an enhancement.

Conclusion: SAP patches are no longer just an IT routine

CVE-2026-27685 is more than a monthly patch. It is a wake-up call for any organization that relies on SAP as the backbone of its business processes. The combination of CVSS 9.1, insider threat vector, and NIS2 liability makes this patch a CEO-level issue. Failure to act now risks not only a security breach but also personal consequences for executives.

Frequently Asked Questions

We are using SAP S/4HANA Cloud. Are we affected?

CVE-2026-27685 specifically affects the NetWeaver Enterprise Portal, not S/4HANA Cloud. However, many companies use hybrid environments where On-Premise NetWeaver components act as gateways to cloud services. Check your architecture: If a NetWeaver system serves as an access layer, it is vulnerable, even if the actual data resides in the cloud.

Our SAP team says the patch requires a maintenance window. How urgent is it really?

SAP categorizes this patch as “Hot News,” the highest urgency level. In practice, this means skipping a regular maintenance window and applying the patch within 24 hours. Test the patch in a sandbox environment and then immediately roll it out to production. The alternative is a system with a publicly known CVSS-9.1 vulnerability.

How do we know if our SAP admin accounts have been compromised?

Standard SIEM systems typically do not detect SAP-specific anomalies. Check SAP audit logs for unusual admin activities: logins outside of business hours, mass permission changes, new RFC connections. Dedicated solutions like SecurityBridge or Onapsis offer automated SAP threat detection. For a systematic approach to securing your software supply chain, see the SBOM Praxis Check.

Do we need to report this patch to the BSI?

You do not need to report the patching itself. However, if you fall under NIS2 and do not apply the patch promptly, the BSI may consider this a breach of risk management obligations during an audit. Document the patching process thoroughly, including timestamps and responsibilities.

Is there a workaround if we cannot patch immediately?

SAP recommends as a temporary measure limiting admin access to the NetWeaver Enterprise Portal. Disable remote admin access, enforce multi-factor authentication for all SAP admin accounts, and closely monitor SAP audit logs. This is not a substitute for the patch but reduces the attack surface.