---
cve: "CVE-2026-76969"
severity: "CRITICAL"
cvss: 9.4
epss: "0.4%"
vendor: "SAP_SE"
kev: false
exploited: false
published: "2026-09-08 01:17:55"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-11-10T19:24:32+01:00"
---

# CVE-2026-76969

> 9.4 CRITICAL

## Beschreibung

@sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and abuse them to replace or delete tenant data. Successful exploitation can result in a high impact on availability and integrity of the application. There may also be partial impact to the confidentiality of business data.

## CNA-Record (Kanon, cvelistV5)

- CNA: **sap**
- State: PUBLISHED
- Stand: 2026-09-08 10:34:58
- CNA-CVSS: **9.4** (`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H`)

## CISA-Anreicherung (vulnrichment/ADP)

- CISA-SSVC (Coordinator, v2.0.3):
  - Exploitation: **none**
  - Automatable: **yes**
  - Technical Impact: **partial**

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Gering | warn |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Schwachstellen-Klasse

- **CWE-522** — Insufficiently Protected Credentials
  The product transmits or stores authentication credentials, but it uses an insecure method that is susceptible to unauthorized interception and/or retrieval.

## Angriffsmuster (CAPEC)

- [CAPEC-50 — Password Recovery Exploitation](https://capec.mitre.org/data/definitions/50.html) _(Severity: High)_
- [CAPEC-102 — Session Sidejacking](https://capec.mitre.org/data/definitions/102.html) _(Severity: High)_
- [CAPEC-474 — Signature Spoofing by Key Theft](https://capec.mitre.org/data/definitions/474.html) _(Severity: High)_
- [CAPEC-509 — Kerberoasting](https://capec.mitre.org/data/definitions/509.html) _(Severity: High)_
- [CAPEC-551 — Modify Existing Service](https://capec.mitre.org/data/definitions/551.html)
- [CAPEC-555 — Remote Services with Stolen Credentials](https://capec.mitre.org/data/definitions/555.html) _(Severity: Very High)_
- [CAPEC-560 — Use of Known Domain Credentials](https://capec.mitre.org/data/definitions/560.html) _(Severity: High)_
- [CAPEC-561 — Windows Admin Shares with Stolen Credentials](https://capec.mitre.org/data/definitions/561.html)

## ATT&CK-Techniken

- [T1552.004 — Unsecured Credentials: Private Keys](https://attack.mitre.org/techniques/T1552/004/)
- [T1558.003 — Steal or Forge Kerberos Tickets:Kerberoasting](https://attack.mitre.org/techniques/T1558/003/)
- [T1543 — Create or Modify System Process](https://attack.mitre.org/techniques/T1543/)
- [T1021 — Remote Services](https://attack.mitre.org/techniques/T1021/)
- [T1114.002 — Email Collection:Remote Email Collection](https://attack.mitre.org/techniques/T1114/002/)
- [T1133 — External Remote Services](https://attack.mitre.org/techniques/T1133/)
- [T1078 — Valid Accounts](https://attack.mitre.org/techniques/T1078/)
- [T1021.002 — Remote Services:SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002/)

## BSI-Hinweise (deutsch)

- [SAP Patch Day September 2026: Mehrere Schwachstellen](https://wid.cert-bund.de/portal/wid/sicherheitshinweis/WID-SEC-W-2026-3220) — _BSI-Einstufung: hoch_
  Ein Angreifer kann mehrere Schwachstellen in SAP Software ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Berechtigungen zu erweitern, vertrauliche Informationen offenzulegen oder zu manipulieren, SQL-Injection-Angriffe durchzuführen oder einen Denial-of-Service-Zustand zu verursachen.

## Referenzen

- <https://me.sap.com/notes/3798315>
- <https://url.sap/sapsecuritypatchday>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/sicherheitsluecken/cve-2026-76969/) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI WID (CSAF)_