Days to Zero: How Ransomware and Accelerated Exploitation are Reshaping SAP Security

A research report brought to you by Onapsis & Recorded Future

Onapsis
123% Surge in Underground SAP Threat Discussions: Security-relevant SAP threat and vulnerability discussions in underground sources more than doubled between 2023 and 2025.
Explosion in Threat Actors Targeting SAP with Ransomware: The number of active ransomware and extortion groups targeting SAP environments expanded dramatically from a single actor in 2022 to over 20 groups in 2026. 
Collapsed Time-to-Exploit SAP Applications: The window between an SAP Security Note release and verified public exploitation or proof-of-concept dropped to just 1–3 days.

THREAT REPORT

Days to Zero: How Ransomware and Accelerated Exploitation are Reshaping SAP Security

Onapsis and Recorded Future have joined forces for a collaboration to illuminate SAP applications. This report covers:

  • +123% growth in SAP-relevant activity on actor-operated underground channels (2023→2025), from 419 to 933 distinct documents.
  • 26 distinct ransomware and extortion groups appeared in SAP-relevant content in 2025, up from 8 in 2023. Across the full 2023 to H1 2026 window, 30 different groups appear at least once.
  • 1 to 3 days median time from SAP Security Note release to first verified public exploitation or proof-of-concept for vulnerabilities patched between 2025 and 2026, down from 489 days for those patched in 2021.

Frequently Asked Questions

The median time from an SAP Security Note release to verified public exploitation or a proof-of-concept collapsed from 489 days for vulnerabilities patched in 2021 to just 1 to 3 days for those patched in 2025–2026. Across all SAP CVEs with verified first-exploitation observations since April 2025, exploitation occurred between 0.3 and 24 days post-disclosure.

Stolen SAP access commands up to a 23x premium on the dark web. While standard administrative access to generic enterprise networks averages roughly $1,300, SAP listings range from $500 up to $30,000.

Attackers are targeting developer packages and trusted-publishing pipelines to harvest credentials, cloud keys, and AI-coding-tool secrets without needing to exploit a traditional SAP vulnerability. In the April-May 2026 “Mini Shai-Hulud” campaign, threat actors deployed a self-replicating worm that compromised official SAP npm packages by abusing CI/CD trusted publishing.

AI is drastically accelerating both defense and attack cycles. Defenders are using AI-augmented techniques to surface more flaws, pushing SAP’s Security Note volume to a projected record high in 2026. Simultaneously, threat actors are using the exact same AI tools to analyze patch binaries, develop automated exploits, and execute mass-scanning campaigns within hours of a vulnerability disclosure.

Organizations should deploy continuous threat detection and incident investigation at the SAP application layer. This acts as a compensating control that catches exploitation attempts against known, unpatched flaws in real time when immediate patching is not feasible.

While the report confirms that securing custom code for a Clean Core applies across RISE with SAP, S/4HANA, and hybrid landscapes, migrating to the cloud does not eliminate application-layer risks. Because attackers are directly targeting the SAP application layer, custom code, and CI/CD pipelines, organizations remain responsible for continuous exposure management and threat detection regardless of whether the system is hosted on-premise or in the cloud.

Two men pair programming at a computer

Stay Ahead of Accelerated SAP Exploits with Onapsis

The “Days to Zero” report proves that adversaries are targeting SAP faster than ever. Don’t leave your business-critical applications exposed to ransomware syndicates and zero-day attacks. Contact our experts today to shift to continuous SAP exposure management and lock down your landscape before the next exploit drops.

Contact Us