ERP Roundup: BC29 Preview, Two CVSS 10.0 SAP Flaws, and Microsoft's AI Migration Tool
Four things happened in the ERP world this week that will end up on somebody's test plan. A Business Central preview that changes how extension fields are physically stored. Two SAP vulnerabilities scored at the top of the scale. An AI tool from Microsoft that will draft your migration test plan. And a set of Oracle numbers that say a lot about where application R&D sits in the pecking order.
1. What is actually inside the BC29 preview
Business Central update 29.0 went into public preview in the first week of September, with general availability scheduled for the first week of October. Microsoft deletes preview sandboxes roughly 30 days after that, so the window to look at it properly is now.
Two items in the preview matter more than the feature list suggests. The first is a new data model for table extensions: Microsoft is storing extension fields in the same underlying table as the base fields rather than in a separate companion table. Microsoft frames this as a performance improvement across all database operations, and it also allows keys that span base and extension fields. The second is ALTool, a command-line route to compile, deploy and run AL test projects with structured JSON results, alongside parameterised AL tests driven from reusable data sources.
What it means for testing
A storage-model change underneath table extensions is the kind of thing that does not appear in any functional test script, because nothing about it is functional. It is exactly what a regression pass exists to catch, and the preview sandbox is where you catch it rather than in a client's production tenant in October. Meanwhile ALTool lowers the cost of running developer-level AL tests in a pipeline. That is welcome, and it is not UAT: an AL test proves the code does what the developer meant, not that the finance team can close a month.
One practical note. The release plan pages most partners used to read this cycle are no longer being published, which we covered separately in what the end of release waves does to your regression testing calendar. The preview sandbox and the "what's new" documentation on Microsoft Learn are now the primary sources. The update itself is unchanged; only the reading material moved.
2. SAP patches two perfect-10 vulnerabilities
SAP's September Security Patch Day, on 8 September, carried two notes rated CVSS 10.0. Note 3747649 (CVE-2026-44756) addresses a memory-safety flaw in Extended Passport processing in the NetWeaver kernel; Pathlock describes an externally supplied length field being trusted without validation, on a request-processing path present in essentially every NetWeaver deployment. Note 3771065 (CVE-2026-58231) covers remote code execution in the SAP Commerce Cloud Data Hub Adapter.
The headline counts differ by who is doing the counting, which is worth knowing if you are reconciling advisories. Onapsis reported 22 new and updated notes with five rated HotNews; Pathlock reported 33 notes, 19 of them new, with seven at HotNews severity. Both agree on the two 10.0s.
What it means for testing
A kernel-level patch on a scored-10 flaw is not a change anyone gets to schedule. It goes in, and it goes in quickly. The question is whether you can then say what it did to the business processes running on top, within days rather than weeks. Practices that keep a standing regression pack can answer that; practices that rebuild scope from memory each time end up choosing between patching fast and knowing what broke. Our guide to UAT on SAP covers what belongs in that standing pack.
3. Microsoft hands partners an AI migration tool
On 9 September Microsoft announced Dynamics 365 Activate, previously known internally as Project Mia, in limited public preview. It is aimed at systems integrators and implementation teams, and Microsoft says it uses AI to analyse data, processes, customisations and dependencies when moving a customer onto Dynamics 365. Salesforce is the first supported source; Microsoft says further CRM and ERP sources will follow. MSDynamicsWorld reports the tool also covers requirements analysis, configuration generation, integration design, security role analysis and test planning, and quotes EVP Jeff Teper describing it as a way to move to Dynamics 365 "faster, with less manual effort and lower migration" risk.
What it means for testing
An AI-generated test plan is an inventory, not acceptance. It is genuinely useful for the thing implementation teams are worst at, which is remembering the obscure process in the corner of the business that only runs at quarter end. It cannot tell you whether the person who owns that process agrees the migrated system does their job. Treat generated scenarios as a first-pass checklist to review with named business owners, and keep the sign-off trail human. The faster the front of a project gets, the more likely the compressed phase is the one just before go-live.
4. Oracle posts a $664bn backlog and negative free cash flow
Oracle reported Q1 FY27 results on 10 September. Revenue rose 30% to $19.3bn, cloud infrastructure revenue grew 121% to $7.4bn, and remaining performance obligations reached $664bn, up $209bn year on year. Free cash flow was negative $5.4bn against $28.5bn of capital expenditure. On the applications side, Fusion grew 14% and industry applications more than 20%.
Oracle also disclosed that the majority of more than $30bn in new AI contracts signed in the quarter came through prepayment, bring-your-own-hardware or similar structures that do not require incremental capital from Oracle. ERP Today notes that the applications business, growing at 14%, nevertheless sits on infrastructure that is currently cash-flow negative.
What it means for testing
Nothing this week, and that is the point of including it. The applications your clients run are a modest slice of a vendor's attention, and the pace of AI feature delivery into them is set by a strategy with very little to do with whether your client's order-to-cash process still works. The features arrive regardless. Someone still has to check them.
The through-line: four stories, one test window
Three of this week's four stories push change into client systems faster: a preview that becomes generally available in three weeks, a security patch nobody gets to defer, and a tool that compresses the front half of a migration. Only one of them comes with a testing calendar attached, and it is the one that ends with a deadline you did not choose. The amount of change going into ERP estates keeps rising. The window in which anyone validates it does not, and on most projects it is the phase that absorbs every overrun upstream. That is why a regression suite that persists between passes has stopped being good practice and started being the only way to keep up.
Free ERP UAT checklist (Excel)
A structured workbook covering the full UAT cycle: pre-UAT preparation tasks, test execution tracking, an issue log with severity guide, and post-UAT wrap-up. Built from real ERP implementations.
No spam. We will occasionally send UAT and ERP implementation resources. Unsubscribe any time.
Sources and further reading
- Microsoft Learn: What's new or changed in Business Central 2026 release wave 2, update 29.0 preview
- Think About IT: What's in Business Central 2026 release wave 2, update 29.0 preview (7 September 2026)
- Onapsis: SAP Security Notes, September 2026 Patch Day (8 September 2026)
- Pathlock: SAP Security Patch Day, September 2026 (8 September 2026)
- Microsoft Partner Center: September 2026 announcements, including Dynamics 365 Activate limited public preview (9 September 2026)
- MSDynamicsWorld: Microsoft's Project Mia to launch as new service focused on bringing Salesforce customers to Dynamics 365 (10 September 2026)
- ERP Today: Oracle Q1 FY27 results, $664bn backlog, negative cash flow (11 September 2026)
More Change, Same Test Window
LogicHive gives ERP implementation teams a regression suite that survives between releases: structured test cases, named assignment, linked defect tracking, and sign-off built from real execution data. When a patch lands or an update ships, running a pass is a scheduling decision rather than a project. The free plan runs a real project end to end.
Written by Sharif George
LogicHive Frontman
Sharif is the frontman for LogicHive. He writes the ERP news roundups and the Business Central release coverage, following each Microsoft, SAP and Oracle change through to what it means for regression scope and acceptance testing on live implementation projects.
View all articles by Sharif GeorgeRelated reading
ERP & Enterprise
Dynamics 365 Release Waves Are Ending: What That Does to Your Regression Testing Calendar
Microsoft is retiring the twice-yearly release wave model in favour of continuous publishing, and the Release Planner retires on 15 November 2026. Business Central still updates on schedule, but the planning checkpoint most partners used as their regression testing calendar has just gone.
12 September 2026 · 5 min read
ERP & Enterprise
Business Central 29 Removes SOAP on Microsoft Pages: The Integration Break UAT Will Not Catch
BC29 removes SOAP endpoints on Microsoft UI pages for good, along with the feature key that kept them alive. Nothing on screen changes, which is exactly why a normal UAT pass will not find it. What to inventory, what to test, and where.
14 September 2026 · 5 min read
ERP & Enterprise
Business Central's Record-and-Replay Test Tool Reached GA This Week. It Is Not UAT.
Microsoft moved the Business Central page scripting tool from preview to general availability with version 29, thirty months after the preview opened, adding multi-row grid selection and dialog-text validation — neither of which the reference documentation describes yet. What a recording actually proves, what it is documented not to reach, and why a replay pipeline is a regression asset rather than an acceptance one.
5 October 2026 · 6 min read