CVE-2026-76958

SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity declarations. Successful exploitation could allow the attacker to read sensitive file contents from the server and expose them through monitoring or logging output, resulting in a high impact on confidentiality. It could also lead to resource exhaustion, causing a low impact on availability. There is no impact on integrity.

• CWE-611

• https://me.sap.com/notes/3792978
• https://url.sap/sapsecuritypatchday

Published

Sep 8, 2026

Last Modified

Sep 8, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-76943Xiiaozet LK100Wt contains an authentication weakness within …9.8
• CVE-2026-76945The affected Ebyte device relies on client-managed authentic…7.5
• CVE-2026-76949Authentication Bypass by Spoofing vulnerability in team-alem…9.1
• CVE-2026-7695A vulnerability has been found in Acrel Electrical EEMS Ente…7.3
• CVE-2026-76956In libexpat 2.8.2 and 2.8.3 before 2.8.4, misinterpretation …7.5
• CVE-2026-76957libexpat before 2.8.4 lacks handler call depth tracking with…7.8
• CVE-2026-76959SAP S/4HANA Finance (Advanced Payment Management) does not p…4.6
• CVE-2026-7696A vulnerability was found in Acrel Electrical EEMS Enterpris…6.3
• CVE-2026-76960SAP S/4HANA Finance (Advanced Payment Management) does not p…3.5
• CVE-2026-76961SAP S/4HANA Finance (Advanced Payment Management) does not p…3.5
• CVE-2026-76962SAP S/4HANA (Manage Bank Chains app) does not perform suffic…4.3
• CVE-2026-76963Due to a missing authorization check in Application Server A…4.3