Prevent Threats with Onapsis Threat Research
Onapsis comprises a premiere team of security experts.
We use our extensive knowledge of critical ERP applications and years of experience in threat research to provide valuable security insights and threat intelligence. We focus on safeguarding crucial business applications from companies like SAP, Oracle, and SaaS providers. Among research teams, Onapsis is the foremost contributor of vulnerability research to the SAP Product Security Response Team, making us unmatched in our field.
Review Our Research
Onapsis Research Labs
The Onapsis Research Labs continuously finds security threats for SAP and Oracle EBS. They warn you about these risks to your business. A team that looks for new threats is crucial to inform you about the latest dangers. They tell you about these threats and advice on how to stay safe, even for vulnerabilities that others don’t know about yet. This way, you’re protected while the ERP vendor fixes the issue.
OVERPASS
A critical pre-authentication flaw residing in SAP Extended Passport Processing (EPP) that can be exploited over the SAP Internet Communication Manager (ICM), which serves as public-facing front doors for every external connection to SAP systems over HTTP(S) (both directly and behind an SAP Web Dispatcher), and is reachable over other SAP communication interfaces (e.g., SAP GUI, RFC) as well.
Exploitation permits a remote actor to execute arbitrary code, resulting in complete host takeover. ORL estimates at least 10,000 Internet-facing SAP systems currently at risk.
This conservative assessment excludes additional backend systems potentially exposed through vulnerable SAP Web Dispatchers or reverse proxies, suggesting a significantly larger global impact.
Watch Onapsis and SAP go over the SAP Security Notes and the immediate remediation steps required to shield your SAP landscape from exploitation.Â
Read our blog to learn more about the threat and potential business impact of this critical vulnerability.
S4GET
A flaw in the SAP NetWeaver Message Server, specifically with SAP kernel 9.16 (the mandatory kernel for S/4HANA 2025 and a kernel option available to earlier S/4HANA versions).
Attackers can inject unauthenticated opcodes to forge “trusted access” for their own machine, unlocking the ability to execute remote commands across the entire SAP network cluster.
Watch Onapsis and SAP go over the SAP Security Notes and the immediate remediation steps required to shield your SAP landscape from exploitation.Â
Read our blog to learn more about the threat and potential business impact of this critical vulnerability.
CVE-2025-31324 ZERO-DAY
On April 24, 2025, SAP released an emergency patch for a CVSS 10.0 zero-day vulnerability that affects SAP Visual Composer, an optional but broadly installed component present in 50-70% of SAP Java systems worldwide.
This vulnerability is actively being exploited in the wild, as noted by Onapsis Threat Intelligence and multiple IR firms and security researchers. It was first publicly reported by ReliaQuest.
Read our resource page to learn more about the threat and potential business impact of this critical zero-day vulnerability:
CH4TTER
Discover the sharp increase in ransomware incidents involving compromised SAP systems and the need for better cybersecurity measures.
Onapsis and Flashpoint have joined forces to level the playfield, revealing how threat actors are attacking SAP applications. CH4TTER report covers:
C2 Incident on SAP
Onapsis Research Labs observed and analyzed malicious activity detected though our global threat intelligence cloud. A system running SAP was compromised and turned into a command and control bot by injecting a malicious file via an SAP vulnerability. The C2 incident initiated a distributed denial of service attack involving Cloudflare.
This paper reviews details of this attack including:
P4CHAINS
After months of research, Pablo Artuso and Yvan Genuer from Onapsis found vulnerabilities named ‘P4CHAINS’.
Read the complete threat report to learn more about their findings:
ICMAD
Onapsis Research Labs spent a year investigating HTTP Response Smuggling, and discovering ICMAD vulnerabilities. The threat report explains:
RECON
The RECON (Remotely Exploitable Code On NetWeaver) vulnerability has a CVSS score of 10 out of 10 and can potentially be exploited impacting the confidentiality, integrity and availability of mission-critical SAP applications. The threat report details:
10KBLAZE
In 2019, several new exploits targeting SAP applications were released in a public forum—named 10KBLAZE. Although the exploits target insecure configurations that have been reported by SAP and Onapsis, their public release significantly increased the risk of successful cyberattacks against SAP landscapes. This threat report describes:
Threat Research Resources
The Onapsis Threat Research Labs offers a variety of resources, including blogs, threat reports, webinars, and advisories.