Cyber & AI intelligence
Wasteland.
Briefs indexed2597
Issues28
Published Mondays07:30 CT
⚡ Active KEV CVE-2026-76969 2026-09-07

CVE-2026-76969: Critical Credential Exposure in SAP CAP Multitenant Extensibility

"A missing authorization check in the `@sap/cds-mtxs` NPM library lets unauthenticated attackers pull sensitive credentials from multitenant SAP Cloud Application Programming Model applications and use them to overwrite…"

A missing authorization check in the @sap/cds-mtxs NPM library lets unauthenticated attackers pull sensitive credentials from multitenant SAP Cloud Application Programming Model applications and use them to overwrite or destroy tenant data.

What Is It

CVE-2026-76969 is a flaw in @sap/cds-mtxs, the multitenancy and extensibility toolkit for SAP's Cloud Application Programming Model. The library does not perform sufficient checks on certain functionality used in multitenant CAP applications that have extensibility enabled. An unauthenticated attacker can send specially crafted requests to obtain sensitive credentials, then abuse those credentials to replace or delete tenant data.

SAP, acting as CNA, scores the issue CVSS 3.1 9.4 (Critical) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H, and classifies the weakness as CWE-522 (Insufficiently Protected Credentials); both values come from the CVE record linked below. That vector describes the worst practical combination: network-reachable, low complexity, no privileges, no user interaction. Impact is high on integrity and availability, with partial impact to the confidentiality of business data.

Why It Matters

Credential theft here is a stepping stone, not the endpoint. Once an attacker holds tenant credentials, the described outcome is data replacement or deletion across tenants in a shared-tenancy deployment; the failure mode multitenant isolation exists to prevent. Because no authentication is required to trigger the initial disclosure, the main remaining barrier appears to be network reachability of the affected endpoint, though the vendor advisory does not enumerate preconditions beyond multitenancy and extensibility being enabled.

A check of CISA's Known Exploited Vulnerabilities catalog (linked below) on 7 September 2026 returns no entry for CVE-2026-76969, and there are no public reports of exploitation in the wild as of that date. That is a snapshot, not a forecast: an unauthenticated, low-complexity credential-disclosure bug in a widely deployed SAP component is arguably the kind of finding that draws attention quickly once a patch is available for diffing, but that is an expectation about attacker behavior rather than an observed trend for this CVE.

What's Vulnerable

SAP SE, SAP Cloud Application Programming Model (CAP), via the @sap/cds-mtxs NPM library. Affected versions, per the SAP CNA record:

The same record lists everything outside these ranges as unaffected by default. Only deployments that are multitenant and have extensibility enabled are in scope.

Patch Status

The CVE record is newly published and still carries a status of "Received," meaning it has not yet been enriched or analyzed by NVD. Remediation details are carried in SAP Note 3798315, released through SAP Security Patch Day.

Administrators running any of the affected @sap/cds-mtxs version ranges should consult that note and upgrade past the listed ceilings. No federally mandated remediation deadline currently attaches to this CVE: BOD 22-01 timelines apply to vulnerabilities in the KEV catalog, and as of the 7 September 2026 check above this CVE is not in it. The combination of unauthenticated access and cross-tenant data destruction still argues for treating it on an emergency-change footing rather than a routine patch cycle. Where an immediate upgrade is not possible, restricting network reachability of the multitenant extensibility endpoints is the interim control that most directly matches the documented attack path, though SAP does not publish it as an official workaround.

Sources