Vendor
SAP
- First Reported
- Apr 29, 2026
- Latest Reported
- Sep 28, 2026
Reported Context (7)
- teams to view agent activity, audit events, and approve or reject agent requests for more permissions. SAP is planning to embed OpenShell in its JouleStudio runtime. Other partners include CrowdStrike, Microsoft, Nvidia Launches Platform to Monitor and Constrain AI Agents
- SAP NetWeaver Visual Composer Recorded Future Identifies 73 High-Impact Vulnerabilities in August, 70 Actively Exploited
- In April 2026, Socket reported that compromised SAP Cloud Application Programming Model (CAP) and Cloud MTA-related npm packages, including mbt and multiple @cap-js/* packages, introduced malicious preinstall behavior Recorded Future Reports 215 Actively Exploited CVEs and Expanding Supply-Chain Threats in H1 2026
- threat actors have delivered KrustyLoader by exploiting internet-facing systems, including Ivanti and SAP NetWeaver appliances, and used that access to write and execute the loader on the compromised host for CIS Analyzes KrustyLoader’s Use of S3 Buckets to Deliver Sliver
- Multiple exploitation frameworks targeting Fortinet, SonicWall, Sophos, Citrix, SAP, Roundcube, and vBulletin were executed in parallel. The operator largely relied on public proof-of-concept exploits, modifying only a Exposed Directory Reveals Russian-Speaking Broker’s Intrusions and Ukraine-Focused Collection
CVE (99)
Malware (56)
People (6)
Threat Actors (25)
MITRE ATT&CK (82)
Vendors (48)
Products (106)
Tools (82)
Industries (26)
Countries (15)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.