DanSec

Vendor

SAP

In 42 briefs, most recently 14 October 2026. RSS for this tag

Learn more: Vulnerabilities (NVD) ↗

Known exploited (CISA KEV)

14 SAP vulnerabilities are on CISA's list of vulnerabilities exploited in the wild, 3 of them used in ransomware campaigns. Most recent:

Coverage in DanSec Daily

  1. Ivanti Connect Secure zero-days chained for root RCE, Microsoft's 1,400-flaw Patch Tuesday with an exploited Windows Shell bug, and a Meta GitHub breach.
  2. Danfoss-targeted French supermarket fridge sabotage, Yandex data center drone strikes, and Ledger spy-chip wallets.
  3. ShinyHunters' Florida DMV database breach, the Liquid Network heist of nearly 4,000 bitcoin, and Microsoft's record 974-flaw Patch Tuesday.
  4. Microsoft Azure account records sold, Pokémon Center and French tax data breaches, and critical Ray RCE actively exploited.
  5. Shell data theft claimed by Clop, RingCentral breach by ShinyHunters exposing 1.6M accounts, and SAP Commerce Cloud RCE under active attack in today's …
  6. RingCentral breach exposing 1.6M accounts, Clop's claimed 89GB Shell theft, and Beacon CRM AWS key leak hitting 1,000+ charities.
  7. Microsoft August Patch Tuesday zero-days, Cisco ASA/FTD exploitation, Mozilla signing key exposure, and Gunra ransomware warnings.
  8. SonicWall SMA 1000 zero-days, Microsoft's record 622-flaw Patch Tuesday and nearly 300 fake GitHub infostealer repos.
  9. Microsoft GitHub repos hijacked in Miasma worm supply chain attack, ServiceNow API breach, Russia-aligned WinRAR espionage, record 206 Patch Tuesday fixes.
  10. Grafana source code theft, the ShinyHunters-linked 7-Eleven breach, and an unpatched zero-day in Microsoft Exchange under active exploitation.
  11. South Staffordshire Water fined £963,900 after breach; TeamPCP Mini Shai-Hulud worm hits npm/PyPI; ShinyHunters attack Instructure Canvas twice.
  12. Roblox credential theft via fake game enhancements, an actively exploited cPanel zero-day, and the Mini Shai-Hulud SAP npm supply chain attack.
  13. The TeamPCP SAP npm supply chain attack, Checkmarx GitHub data theft, and a five-year dormant WordPress plugin backdoor affecting 70,000+ sites.
  14. Ukrainian targeting by UAC-0247's AgingFly malware, a compromised WordPress EssentialPlugin package, and an nginx-ui flaw exploited in the wild …
  15. Covers the Kraken and McGraw-Hill breaches, a fake Ledger Live app on Apple's App Store, and Microsoft's April 2026 Patch Tuesday with 167 flaws.
  16. The Stryker wiper attack by Handala, Michelin's Oracle EBS breach, critical n8n RCE flaws, and Microsoft's March Patch Tuesday fixes.
  17. Ericsson data breach, suspected FBI wiretap network breach, and Salesforce data theft campaign, plus APT28 espionage malware and Ivanti EPM exploitation.
  18. Warlock ransomware breaches SmarterTools via unpatched SmarterMail, Conduent breach exposes Volvo customer data, Ivanti zero-days hit Dutch regulators.
  19. Central Maine Healthcare and Endesa breaches, Microsoft's January 2026 Patch Tuesday zero-days, and GoBruteforcer botnet hitting crypto projects.
  20. React2Shell exploitation, Gladinet CentreStack hard-coded key attacks, WinRAR CVE-2025-6218 abuse, and Fortinet auth bypass patches in this security news brief.
  21. The 64M-record Barcelona data theft arrest, STAC6565 and QWCrypt attacks on Canadian firms, and Microsoft's December 2025 Patch Tuesday zero-days.
  22. The GlobalLogic Oracle EBS data theft, the Rhadamanthys infostealer takedown, and Microsoft's November 2025 Patch Tuesday with 63 flaws including a kernel …
  23. Prince Group crypto seizure, Harvard breached via Oracle E-Business Suite zero-day CVE-2025-61884, and Flax Typhoon ArcGIS backdoor campaign.
  24. Harrods data breach and arrests tied to retail cyberattacks, plus Akira ransomware bypassing MFA on SonicWall SSL VPNs and an EU probe into SAP.
  25. Plex data breach, Adobe's SessionReaper Magento flaw and SAP NetWeaver criticals.
  26. The Wealthsimple breach, the Salesforce-linked attack on Proofpoint and Tanium, SAP S/4HANA CVE-2025-42957 exploitation, and CastleRAT from TAG-150.
  27. Allianz Life Salesforce breach exposes 1.1M records, Play ransomware exploits Windows CLFS, and ActiveMQ attackers deploy DripDropper malware.
  28. The Allianz Life Salesforce data theft, unpatched Citrix NetScaler CitrixBleed 2 exposure, and the Charon ransomware campaign against Middle East public sector …
  29. ShinyHunters vishing breaches at Qantas, Allianz Life and Adidas; SafePay claims 3.5TB Ingram Micro theft; Microsoft SharePoint mass exploitation hits South …
  30. Saint Paul city cyberattack prompting National Guard activation, Aeroflot flight cancellations, and Allianz Life breach hitting 1.4M US customers.
  31. M&S ransomware by DragonForce, the SK Telecom breach exposing 27 million records, and the BaitTrap fake news investment fraud network.
  32. Citrix NetScaler 'CitrixBleed 2' exploitation, Cyber Fattah's leak of 2024 Saudi Games data, and arrests of BreachForums operators in France.
  33. ConnectWise ScreenConnect breach by a suspected nation-state, AVCheck takedown, and China-linked Earth Lamia exploiting SAP NetWeaver and SQL Server flaws.
  34. ConnectWise ScreenConnect breach by suspected nation-state, DragonForce ransomware via SimpleHelp RMM, and Victoria's Secret site outage.
  35. Coinbase breach via bribed support agents, Nucor halted by a cyber incident, and APT28 exploiting webmail zero-days in the RoundPress campaign.
  36. The Coinbase insider data breach and extortion attempt, SAP NetWeaver exploitation by BianLian and RansomExx, and Samsung MagicINFO Mirai attacks.
  37. Marks & Spencer customer data theft, Microsoft May 2025 Patch Tuesday with five zero-days, and SAP NetWeaver exploitation by ransomware gangs.
  38. Ascension healthcare breach affecting 430,000+ patients, Insight Partners breach widening, and LockBit affiliate panel leaked.
  39. Pearson breach, Insight Partners data theft, and Toronto school district ransom, plus SonicWall and Cisco flaws and Qilin ransomware activity.
  40. Marks & Spencer ransomware disruption by Scattered Spider, SAP NetWeaver CVE-2025-31324 exploitation, and Hitachi Vantara Akira attack.
  41. The M&S cyberattack, Craft CMS zero-day exploitation and SAP NetWeaver server hijacks, plus the Earth Kurma APT campaign in Southeast Asia.
  42. Marks & Spencer cyberattack halts online orders, SAP NetWeaver zero-day exploited with web shells, and Craft CMS zero-days hit servers. Plus MTN breach and Salt …