A joint study by Onapsis Research Labs and Recorded Future analyzes more than 1.2 million threat-intelligence events. According to the authors, more and more ransomware groups are targeting SAP, and the time between a patch and first exploitation has shrunk from months to days.
Attackers no longer wait for defenders to catch up. According to a new threat report from Onapsis Research Labs and Recorded Future, the median time between the release of an SAP Security Note and the first verified public exploitation or proof-of-concept has fallen from 489 days for vulnerabilities patched in 2021 to between one and three days for those patched in 2025 and 2026.
The report, titled “Days to Zero” and published in October 2026, analyzes 1,238,037 events from Recorded Future’s open-, deep- and dark-web collection between 2023 and the first half of 2026. The authors filtered the material for genuine, human-origin SAP relevance and verified the highest-stakes claims case by case. By their count, relevant threat documents rose from 791 in 2023 to 2,458 in 2025, an increase of 211 percent, with roughly 2,600 estimated for 2026. Activity on actor-operated underground channels grew 123 percent, from 419 to 933 documents. The researchers stress that the figures are deliberately conservative and that the trend, not the absolute volume, carries the message.
Ransomware interest has broadened considerably. In 2023, eight distinct ransomware and extortion groups appeared in SAP-relevant content, with LockBit accounting for most of the volume. By 2025, the report counts 26 groups, among them Cl0p, Akira, BianLian, Qilin, RansomEXX, Medusa and Play; across the entire period, 30 appear at least once. The authors point to Qilin’s encryptor, which is documented to terminate SAP processes before encrypting, and to 11 Qilin leak-site victims with “SAP” in their exfiltrated file names within about 40 days in early 2026. They also note that the alliance of Scattered Spider, ShinyHunters and LAPSUS$ published a working exploit for CVE-2025-31324 in August 2025.
That critical SAP NetWeaver zero-day serves as the report’s case study. Independent reporting from Verizon and Mandiant ranked it among the most exploited vulnerabilities of 2025. According to the authors, the campaign unfolded in three waves: China-nexus operators such as UNC5221 and Earth Lamia began with reconnaissance in January and active exploitation by February and March; ransomware groups including BianLian, RansomEXX and Qilin followed from late April; and a public proof-of-concept in August opened the door to commodity use. Within about two weeks of disclosure, researchers catalogued 1,284 exposed instances, 474 of them already compromised.
A functioning market has formed around this access. Observed SAP listings range from $500 to $30,000, compared with Verizon’s 2026 benchmarks of roughly $1,300 for administrative and $700 for user access. Examples cited include webshell access to a NetWeaver system at a company with $3 billion in revenue for $500, and management access to an Israeli bank’s SAP systems for $30,000. For comparison, the Crowdfense exploit-acquisition program lists an SAP remote code execution capability at up to $250,000. Even commodity tooling has arrived: a ransomware builder advertised in 2026 named SAP-running enterprises among its targets for as little as $500.
The report describes artificial intelligence as an accelerant on both sides. SAP released 165 Security Notes in 2023, 141 in 2024 and 216 in 2025, and 111 in the first half of 2026, putting the year on course for a new high. Onapsis says its own research output has roughly doubled over the past year using AI-augmented techniques, while attackers use similar tools to weaponize flaws faster. The report also cites Mandiant’s M-Trends 2026, which puts mean time-to-exploit at minus seven days for 2025, and VulnCheck data showing the disclosure-to-KEV interval shrinking from 8.5 to 5 days. A 2026 campaign shows the attack surface extends beyond SAP’s products: TeamPCP’s self-replicating “Mini Shai-Hulud” worm compromised official SAP npm packages and harvested credentials and cloud keys without exploiting any SAP vulnerability.
The recommendations center on four pillars. Treat SAP HotNews and High Priority Security Notes as emergency-cadence work and prioritize the rest by exploitation likelihood and business impact; quarterly patching, the authors argue, is no longer sufficient for internet-facing SAP. Where patching is not possible, deploy application-layer monitoring, including in development and QA environments. Extend DevSecOps controls to custom code and CI/CD pipelines. And rely on SAP-specific threat intelligence that refreshes faster than the monthly Patch Day cycle.
Readers should weigh the source. Onapsis sells SAP security products, and the conclusions reflect its and Recorded Future’s own analysis. The authors themselves note that the classifier is reliable for trend shape rather than exact counts, that group counts carry a margin of one to two, and that the 2023 time-to-exploit figure rests on a single case of 346 days. They also stress that every exploited vulnerability named has been patched by SAP; the risk, they write, stems from capable attackers and unpatched or exposed systems, not from the software itself. SAP is neither author nor publisher of the report.
Dr. Jakob Jung is Editor-in-Chief of Security Storage and Channel Germany. He has been working in IT journalism for more than 20 years. His career includes Computer Reseller News, Heise Resale, Informationweek, Techtarget (storage and data center) and ChannelBiz. He also freelances for numerous IT publications, including Computerwoche, Channelpartner, IT-Business, Storage-Insider and ZDnet. His main topics are channel, storage, security, data center, ERP and CRM.
Contact via Mail: jakob.jung@security-storage-und-channel-germany.de