cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

SAP Patches Critical OVERPASS Kernel Flaw and S4GET NetWeaver Vulnerability

· Original article ↗

Summary

SAP’s September 2026 updates fix 20 flaws, including OVERPASS, a SAP Kernel buffer overflow that can enable administrative command execution, and S4GET, a NetWeaver Message Server authentication flaw that can expose clusters to remote code execution.

Key points

  • SAP fixed 20 vulnerabilities across multiple products in its September 2026 security updates.
  • CVE-2026-44756 (OVERPASS) is a buffer overflow in the SAP Kernel Extended Passport Protocol processing library.
  • The article says unauthenticated attackers could exploit OVERPASS through SAP Internet Communication Manager to run commands with administrative privileges and compromise SAP hosts.
  • Onapsis estimates that more than 10,000 internet-facing SAP systems may be exposed; the estimate is based on publicly reachable interfaces and may undercount systems.
  • CVE-2026-58240 (S4GET) is a missing-authentication flaw in the NetWeaver Message Server that could enable remote command execution across an SAP system cluster.
  • SAP also patched CVE-2026-58231 in Commerce Cloud the previous month; Defused flagged it as actively exploited days after patching.

Article Details

Vulnerability Types
  • Buffer overflow in the SAP Kernel Extended Passport Protocol (EPP) processing library
  • Missing authentication in the SAP NetWeaver Message Server
Severity
Maximum severity for CVE-2026-44756; critical for CVE-2026-58240.
Exploitation Status
reported
Exploit Availability
unknown
Patch Status
available

CVE

CVE-2026-44756SAP_SE · SAP Extended Passport (EPP) ProcessingSAP’s September 2026 security updates fix 20 vulnerabilities, including CVE-2026-44756 (OVERPASS), a maximum-severity SAP Kernel memory corruption flaw that can let attackers run commands with administrative privilegesCVE-2026-58231SAP_SE · SAP Commerce Cloud (Data Hub Adapter)Last month, SAP fixed another maximum-severity vulnerability (CVE-2026-58231) in the Commerce Cloud cloud-based e-commerce platform, which threat intelligence company Defused flagged as actively exploited in attacksCVE-2026-58240SAP_SE · SAP NetWeaver (Message Server)SAP also patched CVE-2026-58240 (S4GET) in the NetWeaver Message Server, a missing-authentication flaw that can expose entire SAP clusters to remote code execution.

People

JP Perez-EtchegoyenOnapsis CTO who described the estimate of more than 10,000 Internet-facing SAP systems.Pablo ArtusoOnapsis security researcher who explained the exposure and impact of CVE-2026-58240.

Vendors

SAPSAP’s September 2026 security updates fix 20 vulnerabilities, including CVE-2026-44756 (OVERPASS), a maximum-severity SAP Kernel memory corruption flaw that can let attackers run commands with administrative privileges

Products

SAP Application Servercan be exploited over SAP Internet Communication Manager (ICM), the networking component of the SAP Application Server that connects the SAP System (SAP NetWeaver Application Server) to the Internet via HTTP, HTTPS,SAP Internet Communication Manager (ICM)The flaw can be exploited over SAP Internet Communication Manager (ICM), the networking component of the SAP Application Server that connects the SAP System (SAP NetWeaver Application Server) to the Internet via HTTP,SAP Kernel2026 security updates fix 20 vulnerabilities, including CVE-2026-44756 (OVERPASS), a maximum-severity SAP Kernel memory corruption flaw that can let attackers run commands with administrative privileges and fullySAP NetWeaver Message ServerToday, SAP also addressed CVE-2026-58240, a critical missing authentication vulnerability in the SAP NetWeaver Message Server named S4GET by Onapsis Research Labs.

Related Articles