SAP attacks triple as exploit window shrinks to days
Fri, 13th Nov 2026 (Today)
Onapsis and Recorded Future have published a joint report on threats targeting SAP environments, warning that the pace and volume of attacks have risen sharply.
SAP-relevant threat activity more than tripled between 2023 and 2025, rising from 791 to 2,458 distinct human-origin threat documents. The study projects that figure will reach 2,600 in 2026.
The time between the release of an SAP Security Note and verified public exploitation or proof-of-concept has also narrowed dramatically. In 2021, the median period was 489 days. By 2025 and 2026, it had fallen to between one and three days.
That shift has reduced the time available to patch systems that often sit at the centre of finance, procurement, manufacturing and supply chain operations. For SAP vulnerabilities with verified first-exploitation observations since April 2025, exploitation occurred between 0.3 and 24 days after disclosure.
Ransomware focus
The report also pointed to growing interest from ransomware and extortion groups. SAP-related ransomware activity involved eight groups in 2023, while the number of distinct ransomware and extortion groups appearing in SAP-relevant content rose to 30 across 2023 to the first half of 2026.
Among the groups named were Qilin, Scattered Spider, LAPSUS$ and ShinyHunters. Qilin modified its encryptor to terminate SAP background services before file encryption. The report also said 11 Qilin leak-site victims in a 40-day period in early 2026 had exfiltrated files labelled 'SAP'.
Activity in underground forums, messaging channels and leak sites also increased. SAP-relevant documents in actor-operated channels rose from 419 in 2023 to 933 in 2025, a 123% increase.
Access prices
Listings for stolen SAP access can command far higher prices than standard access to corporate networks. While generic enterprise administrative access averages about USD $1,300, SAP access listings ranged from USD $500 to USD $30,000.
Examples in the study included high-privilege access linked to a US federal logistics agency listed for USD $12,000, direct management access to core SAP systems at an Israeli banking institution offered for USD $30,000, and SAP BusinessObjects administrative panel access at an Egyptian infrastructure holding company auctioned for USD $1,000.
The report attributed some of the pressure on defenders and attackers alike to artificial intelligence tools. It said AI-assisted research had helped drive a forecast of about 220 SAP Security Notes in 2026, while adversaries were using similar tools to analyse binaries, build exploits and scan internet-facing ERP systems more quickly.
Onapsis said the findings show patching cycles measured in quarters are no longer keeping pace with observed exploitation windows. The report argued that organisations should move beyond standard patch management routines towards exposure management, while using application-layer monitoring when systems cannot be updated immediately.
It also called for tighter controls over SAP development environments and build pipelines, including custom ABAP code and AI-related workflows. Build environments, it said, should be treated with the same security controls as production systems.
"Time-to-Exploit Has Collapsed to 1-3 Days: The median window between an SAP Security Note release and active public exploitation or proof-of-concept dropped from 489 days in 2021 to 24-72 hours in 2025-2026, rendering traditional quarterly patching obsolete," said the Onapsis Threat Research Team at Onapsis.
"Ransomware Syndicates Target the ERP Core Directly: Ransomware interest broadened from 8 distinct groups in 2023 to 26 in 2025, with 30 unique groups appearing in SAP-relevant content across 2023 to H1 2026, including Qilin, Scattered Spider, LAPSUS$, and ShinyHunters, with groups building custom scripts to terminate SAP services prior to encryption," said the team.