Prevent Threats with Onapsis Threat Research
Onapsis comprises a premiere team of security experts.
We use our extensive knowledge of critical ERP applications and years of experience in threat research to provide valuable security insights and threat intelligence. We focus on safeguarding crucial business applications from companies like SAP, Oracle, and SaaS providers. Among research teams, Onapsis is the foremost contributor of vulnerability research to the SAP Product Security Response Team, making us unmatched in our field.
Review Our Research
Onapsis Research Labs
The Onapsis Research Labs continuously finds security threats for SAP and Oracle EBS. They warn you about these risks to your business. A team that looks for new threats is crucial to inform you about the latest dangers. They tell you about these threats and advice on how to stay safe, even for vulnerabilities that others don’t know about yet. This way, you’re protected while the ERP vendor fixes the issue.
CVE-2025-31324 ZERO-DAY
On April 24, 2025, SAP released an emergency patch for a CVSS 10.0 zero-day vulnerability that affects SAP Visual Composer, an optional but broadly installed component present in 50-70% of SAP Java systems worldwide.
This vulnerability is actively being exploited in the wild, as noted by Onapsis Threat Intelligence and multiple IR firms and security researchers. It was first publicly reported by ReliaQuest.
Read our resource page to learn more about the threat and potential business impact of this critical zero-day vulnerability:
CH4TTER
Discover the sharp increase in ransomware incidents involving compromised SAP systems and the need for better cybersecurity measures.
Onapsis and Flashpoint have joined forces to level the playfield, revealing how threat actors are attacking SAP applications. CH4TTER report covers:
C2 Incident on SAP
Onapsis Research Labs observed and analyzed malicious activity detected though our global threat intelligence cloud. A system running SAP was compromised and turned into a command and control bot by injecting a malicious file via an SAP vulnerability. The C2 incident initiated a distributed denial of service attack involving Cloudflare.
This paper reviews details of this attack including:
P4CHAINS
After months of research, Pablo Artuso and Yvan Genuer from Onapsis found vulnerabilities named ‘P4CHAINS’.
Read the complete threat report to learn more about their findings:
ICMAD
Onapsis Research Labs spent a year investigating HTTP Response Smuggling, and discovering ICMAD vulnerabilities. The threat report explains:
RECON
The RECON (Remotely Exploitable Code On NetWeaver) vulnerability has a CVSS score of 10 out of 10 and can potentially be exploited impacting the confidentiality, integrity and availability of mission-critical SAP applications. The threat report details:
10KBLAZE
In 2019, several new exploits targeting SAP applications were released in a public forum—named 10KBLAZE. Although the exploits target insecure configurations that have been reported by SAP and Onapsis, their public release significantly increased the risk of successful cyberattacks against SAP landscapes. This threat report describes:
Threat Research Resources
The Onapsis Threat Research Labs offers a variety of resources, including blogs, threat reports, webinars, and advisories.