# SAP and ERP system cybersecurity vulnerabilities

> Live situation record from CLSTR: https://clstr.news/situations/sap-and-erp-system-cybersecurity-vulnerabilities
> Updated: 2026-10-12T00:41:31.000Z. Sources: 7. Developments: 2.

Security experts have identified significant vulnerabilities within Enterprise Resource Planning (ERP) systems, specifically focusing on SAP environments. Onapsis warned that the complex architectures of these systems require dedicated security strategies and integration into existing Security Operations Center processes, particularly following the discovery of critical vulnerabilities in September.

Further analysis highlights a growing gap in DevSecOps implementation for SAP. While organizations aim to integrate security throughout the software development life cycle, SAP’s monolithic architecture makes patching difficult. It currently takes an average of 97 days to test and deploy SAP patches, a timeline that lags significantly behind the 72 hours required for cybercriminals to weaponize new vulnerabilities. Research indicates a 210 percent increase in the active exploitation of SAP vulnerabilities between 2024 and 2025.

## Timeline

### 2026-10-12: SAP environments face critical DevSecOps security gaps

As the DevSecOps market grows, a critical security gap has emerged in SAP environments, where slow patching cycles leave business-critical applications vulnerable to rapid exploitation.

2 sources. https://clstr.news/cluster/sap-environments-face-critical-devsecops-security-gaps

### 2026-10-07: ERP systems require specialized security focus, Onapsis warns

Onapsis warns that ERP systems like SAP require specialized security due to their complexity, following recent critical vulnerabilities. Meanwhile, Kaseya reports human error as a top cybersecurity threat.

5 sources. https://clstr.news/cluster/erp-systems-require-specialized-security-focus-onapsis-warns

---
Cite as: SAP and ERP system cybersecurity vulnerabilities. CLSTR, https://clstr.news/situations/sap-and-erp-system-cybersecurity-vulnerabilities
