Onapsis and Recorded Future Say the Time From an SAP Patch to a First Exploit Fell From 489 Days to 1 to 3. The Summary Does Not Show How the Median Was Built, So Read It as Direction, Not a Clock.
If you run SAP, plan on attackers having a working exploit or public proof of concept within days of a patch, and decide now who is on the hook to patch the critical notes inside that window. Onapsis and Recorded Future published "Days to Zero" on October 29, 2026, and SecurityWeek covered it on November 6. Their headline is that the median gap between an SAP security note and the first verified exploit or public proof of concept (PoC) fell from 489 days for 2021 patches to 1 to 3 days for 2025 and 2026 patches.
What the study claims
From Onapsis's own summary page, which is the source we read:
- The median time from SAP Security Note release to verified public exploitation or PoC was 489 days for 2021 patches, and 1 to 3 days (24 to 72 hours) for 2025 and 2026 patches.
- Since April 2025, every SAP CVE with a verified first-exploitation observation was exploited between 0.3 and 24 days after disclosure.
- Onapsis forecasts about 220 SAP Security Notes in 2026, which it calls a record.
- Ransomware and extortion groups mentioned alongside SAP rose from 8 in 2023 to 26 in 2025, and 30 unique groups appear from 2023 through the first half of 2026. Named groups include Qilin, Scattered Spider, LAPSUS$, ShinyHunters, BianLian, RansomEXX and Akira.
- Human-origin SAP-relevant threat documents rose from 791 in 2023 to 2,458 in 2025, up 211 percent. Documents from actor-operated channels such as underground forums, messaging and leak sites rose from 419 to 933, up 123 percent.
- Underground listings for SAP access ran from $500 to $30,000. Onapsis gives about $1,300 as the average for standard enterprise network access. Its examples are unnamed: $12,000 for a U.S. federal logistics agency, $30,000 for core SAP management access at an Israeli bank, and $1,000 for a BusinessObjects admin panel at an Egyptian infrastructure holding.
- Qilin reportedly updated its encryptor to stop SAP background services before encrypting, and in a 40-day window in early 2026, 11 Qilin leak-site victims had exfiltrated files labeled "SAP."
Secondary coverage says the study draws on more than 1.2 million threat-intelligence events from 2023 through the first half of 2026. The summary page does not state that.
What the page does not say
This is the part to hold on to. The summary page does not say how the medians and the 0.3 to 24 day range were calculated, how many CVEs sit behind them, or what counts as "verified" exploitation or a PoC. It gives no figures for 2022 to 2024, so we cannot see the slope between 489 days and 1 to 3. It does not say how the listing prices were verified or when the listings ran.
There is a second caution. A median of "1 to 3 days" over a small number of exploited CVEs can move a lot if one or two flaws change. And Onapsis sells SAP security monitoring. Its three recommendations, which are exposure-based prioritization, continuous application-layer threat detection and securing the SAP development pipeline, line up with what it sells. That does not make them wrong. It means the study is a vendor's own measure of its own market.
SecurityWeek's roundup also states that SAP CVEs with confirmed exploitation or a public PoC rose from 9 to 18 between late 2023 and mid-2026. We did not find that figure on Onapsis's summary page, so we cannot trace it. German coverage of the study gives 22 distinct ransomware groups for the first half of 2026, which we also did not find on the page.
Why we still take the direction seriously
We saw the same shape in August. We wrote then about an SAP Commerce Cloud flaw rated CVSS 10.0 (CVE-2026-58231): SAP shipped a fix on a Tuesday, and researchers at Defused saw the first exploitation attempts on their honeypots three days later, with no public proof of concept yet. One flaw is an anecdote, not a median, but it fits.
CISA's catalog tells the same story for older SAP bugs. Our KEV index holds SAP NetWeaver entries going back years, including the Visual Composer flaws CVE-2025-31324 and CVE-2025-42999 from 2025. We hold exploit repositories for CVE-2025-31324, including ones published by Onapsis itself for scanning and compromise assessment.
What to do
- Decide who owns SAP HotNews and High Priority notes, and put them on an emergency cadence that is measured in days. A monthly patch window does not fit a 1 to 3 day claim.
- Find SAP systems that can be reached from the internet, including Visual Composer, Message Server and admin consoles, and close what does not need to be open. This is a cheaper step than patching and removes the target.
- Where you cannot patch quickly, use virtual patching or application-layer detection as a stopgap. The study makes this case, and we agree it is the right fallback.
- Check that SAP systems are on your ransomware plan. The reported Qilin behavior of stopping SAP services before encryption means a restore test for SAP belongs in the plan.
- Treat price lists as context, not evidence. If SAP access really sells for $500 to $30,000, the sellers are not choosing targets by size.
What our own edge saw
Since October 9 our edge saw no request matching common SAP exploit paths, including the Visual Composer metadata uploader and SAP development server paths, in 47,347 blocked requests, 24,641 canary hits or 836 origin-honeypot hits. We run no SAP canary, so this means those paths did not reach our blocks, not that nobody is scanning for SAP.
Indicators
None. The study is research on trends, not a campaign, so there is nothing to add to the feed.
Limits
We read Onapsis's summary page and SecurityWeek's roundup. We did not read the full report or the Recorded Future side of it, and we could not see its method. Every figure above is the study's, as summarized on the page.
Five percent of this is wrong somewhere. It always is. The full report's methodology section will say whether 1 to 3 days is a firm median or a thin one.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.