Three recent disclosures point to one thread: the vulnerabilities that matter most are the ones that should never have shipped. SAP's November 2026 security updates patched 35 flaws, four of them at maximum severity, in NetWeaver, Web Dispatcher and Gateway software, as BleepingComputer reported. Any internet-connected vehicle from two major automakers could be remotely unlocked and started, Tom's Hardware reported, via now-patched failures in API backend security that the outlet described as a lack of 101-level best practices. And a software engineer Rickrolled his Prusa 3D printer through a remote code execution exploit, also reported by Tom's Hardware, that has since been fixed. The details differ, but the common signal is that some of the most damaging holes reaching end users are not exotic research finds. They are ordinary mistakes that survived design, development and testing at organizations with every incentive to catch them.
The Entry Points Are Everyday Stuff
SAP's affected products are not consumer gadgets. NetWeaver, Web Dispatcher and Gateway sit in the application layer that companies build and run core business processes on, which is precisely why maximum-severity ratings there carry weight. The automotive case is more concrete still: an API backend is the plumbing behind connected features, and weakness there turned a routine convenience into a way to open doors and start engines on networked vehicles from two automakers. The Prusa case is the smallest in scale but the clearest in kind, a printer on a network that a determined outsider could push commands to. In each instance the flaw lived in a layer that is supposed to enforce who is allowed to do what, and in each instance it did not.
Patch Volume Is Not the Same as Posture
The instinct when reading SAP's numbers is to treat them as a sign of rigor. Thirty-five fixes in a monthly cycle, including four maximum-severity issues, reflects a vendor that finds and ships remediation. That interpretation is fair as far as it goes, but it measures output, not defense. A vulnerability that earns the top severity rating and touches business-critical software was present and exploitable before it was found, and the count of fixes says nothing about how many equivalent defects are lurking or how long they persisted. The same arithmetic applies to the two automakers and to Prusa. The industry's habit of treating patch disclosures as a scoreboard obscures the question that matters to buyers: was the security designed in, or appended after the fact?
Three Industries, One Class of Defect
It would be tidy to say this is an automotive problem, or an industrial software problem, or a niche hobbyist concern. The evidence says otherwise. Enterprise application software, connected vehicles and consumer 3D printers are about as far apart on the product map as anything on this beat, yet the failures cluster around access control, backend API design and remote reachability. That spread is the argument. The chokepoints that protect these systems are conceptually simple and well documented, and the vulnerabilities that emerged at all three suggest those chokepoints were treated as implementation details rather than security boundaries.
