Latest Threats and Vulnerabilities to Mission-Critical SAP Applications

The talk starts with why SAP and other ERP platforms matter. They run finance, procurement, HR and sales processes, so downtime or data theft quickly becomes a business problem. The speaker argues these systems sit in a security gap, since security, operations and compliance teams each see only part of them, and patching has often lagged far behind other enterprise assets.

The middle of the talk presents observed activity from a threat intelligence network and from incident response work. Over roughly six months, the researchers confirmed several hundred exploitation attempts, with more than a hundred attackers logging in interactively. Three examples are covered: a Java-based portal flaw that allowed automatic creation of an administrator account, a critical flaw exploited months before any public exploit appeared, and default or privileged accounts with weak passwords. In the worst cases, exploitation followed a patch release within 72 hours. A recorded demo showed attacker sessions browsing configuration settings and business data.

The closing takeaways are practical. Teams should treat SAP like other critical servers, prioritize fast patching for severe notes, check which systems are exposed, and address misconfigurations as well as CVEs. The speaker pointed to a report released with SAP that lists timelines, techniques and indicators of compromise for defenders to check their own logs.