SAP security teams are facing a much shorter window to respond to newly disclosed vulnerabilities, according to research from Onapsis and Recorded Future. For vulnerabilities patched in 2025–2026, the researchers report a median of just one to three days between an SAP Security Note release and the first verified public exploitation or proof-of-concept, compared with 489 days for vulnerabilities patched in 2021.
The findings, published in the companies’ Days to Zero research overview, point to growing pressure on organizations that depend on SAP for finance, procurement, manufacturing and supply chain operations. A response process measured in weeks can leave exposed systems vulnerable before a scheduled maintenance window arrives.
The analysis draws on more than 1.2 million threat-intelligence events spanning 2023 through the first half of 2026, according to the companies. Onapsis published its accompanying research summary on October 29.
Underground activity and ransomware interest expand
The researchers identified 933 distinct SAP-relevant documents on actor-operated underground channels in 2025, up from 419 in 2023, an increase of approximately 123%. Those sources include underground forums, messaging channels and leak sites.
Ransomware and extortion groups also appeared more frequently in SAP-related material. The research identified 26 distinct groups in SAP-relevant content during 2025, compared with eight in 2023. Across the full period from 2023 through the first half of 2026, 30 groups appeared at least once.
These figures measure documents and group appearances in the researchers’ sources. They do not represent a count of successful SAP breaches or establish that every named group exploited an SAP vulnerability.
Some of the activity nevertheless points to deliberate efforts to disrupt enterprise applications. In its published research summary, Onapsis says the Qilin ransomware group updated its encryptor to terminate SAP background services before encrypting files. It also reports that 11 Qilin leak-site victims had exfiltrated files explicitly labeled “SAP” during a 40-day period in early 2026.
Faster exploit availability changes patch priorities
The reported one-to-three-day median combines two milestones: verified public exploitation and publication of a proof-of-concept. A publicly available demonstration is not necessarily evidence of an attack against a production system, but it can lower the barrier for attackers seeking to reproduce an exploit.
The comparison also concerns vulnerabilities with observed milestones, rather than every SAP vulnerability. The public summary does not provide the sample size behind each annual median, which limits how precisely readers can assess the change across years.
For enterprise IT teams, the operational challenge is coordinating security response with the availability requirements of business-critical systems. Taking an ERP application offline for remediation can affect transaction processing and production schedules, while delaying a critical fix can extend exposure.
Onapsis recommends prioritizing SAP HotNews and High-Priority Security Notes through an accelerated response process, supported by threat intelligence and an assessment of actual exposure. Where immediate patching is impractical, it recommends continuous monitoring at the SAP application layer as a compensating control.
The researchers also call for stronger protection of custom ABAP code, software dependencies and cloud build pipelines. Their recommendations extend SAP security responsibilities into development environments, where compromised credentials or publishing workflows can create another route into enterprise systems.
Sources
ERP News Editorial Team
The ERPNews Editorial Team covers global developments in ERP (Enterprise Resource Planning), enterprise software, cloud platforms, AI, automation, and digital transformation, providing independent news and editorial analysis for senior business and technology leaders. Our reporting focuses on market signals, strategic shifts, and enterprise impact across the ERP and enterprise technology ecosystem.
For editorial inquiries, please contact:
đź“© [email protected]
