started · updated
SAP security: Exploit window shrinks to days as ransomware activity rises
A joint report by Onapsis and Recorded Future reveals a significant acceleration in threats targeting SAP systems. Analyzing over 1.2 million threat intelligence events from 2023 to mid-2026, the study found that the median time between the release of an SAP security update and the first observed exploit or public proof of concept has plummeted. In 2021, this window averaged 489 days, but for vulnerabilities patched in 2025 and 2026, it has dropped to just 1 to 3 days.
The investigation highlights a growing landscape of targeted attacks. The number of ransomware groups specifically targeting SAP-relevant sources rose from eight in 2023 to 26 in 2025. Additionally, SAP-relevant threat intelligence documents increased by 211 percent, rising from 791 in 2023 to 2,458 in 2025. Activity in attacker-operated underground channels also saw a 123 percent increase, with documents rising from 419 to 933.
Specific threats include the ransomware group Qilin, which can terminate SAP services before encrypting systems. Furthermore, a market for compromised SAP credentials has emerged, with prices ranging between 500 and 30,000 US dollars.
Entities
Onapsis · Qilin · Recorded Future · SAP
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 8 SOURCES] The number of ransomware groups with SAP relevance rose from eight in 2023 to 26 in 2025. www.artikel-presse.de · www.pr-neuigkeiten.de · pressnetwork.de · schlaunews.de · www.pflumm.de · +3 more
- [● 8 SOURCES] The study analyzed more than 1.2 million threat intelligence events from 2023 to mid-2026. www.artikel-presse.de · www.pr-neuigkeiten.de · pressnetwork.de · schlaunews.de · www.pflumm.de · +3 more
- [● 8 SOURCES] SAP-relevant documents in underground channels increased from 419 to 933. www.artikel-presse.de · www.pr-neuigkeiten.de · pressnetwork.de · schlaunews.de · www.pflumm.de · +3 more
- [● 8 SOURCES] SAP-relevant threat intelligence documents increased from 791 in 2023 to 2,458 in 2025. www.artikel-presse.de · www.pr-neuigkeiten.de · pressnetwork.de · schlaunews.de · www.pflumm.de · +3 more
- [● 8 SOURCES] The median time between SAP security updates and the first exploit fell from 489 days in 2021 to 1–3 days in 2025 and 2026. www.artikel-presse.de · www.pr-neuigkeiten.de · pressnetwork.de · schlaunews.de · www.pflumm.de · +3 more
- [● 3 SOURCES] A market for compromised SAP credentials has emerged with prices between 500 and 30,000 US dollars. www.it-daily.net · www.all-about-security.de · www.globalsecuritymag.com
- [● 8 SOURCES] The ransomware group Qilin can terminate SAP services before encrypting systems. www.artikel-presse.de · pressnetwork.de · schlaunews.de · www.globalsecuritymag.com · www.it-daily.net · +3 more