Proxyware crew hijacks D-Link, Ubiquiti, SAP via old CVEs
GreyNoise found 143 devices in 34 countries enrolled into the Pawns.app residential-proxy network via CVE-2024-3273, Log4Shell, and SAP NetWeaver's CVE-2025-31324.
Stories tagged: #sap
SAP Cloud SDK for Python OAuth2 SSRF (CVE-2026-89111, CVSS 10.0)
An unauthenticated SSRF in SAP Cloud SDK for Python lets an attacker who controls tenant_subdomain redirect OAuth2 token requests and steal client credentials. Fixed in 0.45.2.
SAP patches NetWeaver ABAP memory corruption (CVE-2026-44747, CVSS 9.9)
SAP's July 14 Patch Day ships 16 notes: a NetWeaver ABAP memory-corruption bug at CVSS 9.9, an Approuter request-smuggling flaw and Commerce Cloud default credentials both at 9.1.