Onapsis

Mentions · 7d0
Mentions · 30d0
All mentions5
First seenAug 12, 2026
Last mentionedSep 9, 2026

Timeline

5 articles · newest first

SAP Patches Maximum Severity “Overpass” Flaw

Onapsis warns over 10,000 internet-facing SAP systems may be exposed to maximum-severity unauthenticated RCE flaw CVE-2026-44756 in SAP Extended Passport.

Infosecurity MagazineSep 9, 08:15 UTC · Sep 9, 2026VulnerabilityCVE-2026-44756 CVE-2026-58240 CVE-2026-76969+11 · 1 read

SAP Patches CVSS 10.0 Kernel Flaw Enabling Unauthenticated Remote Code Execution

SAP patched CVE-2026-44756 (CVSS 10.0), an unauthenticated kernel memory corruption allowing OS command execution, plus three other critical flaws.

The Hacker NewsSep 9, 06:25 UTC · Sep 9, 2026VulnerabilityCVE-2026-44756 CVE-2026-58240 CVE-2026-76969+12

September 2026 Patch Tuesday roundup: Plugs for two zero day holes among almost 1,000 fixes in Windows

Microsoft's September 2026 Patch Tuesday ships 964 fixes including two exploited Windows zero-days (CVE-2026-85880, CVE-2026-81963) and a wormable DNS RCE.

CSO OnlineSep 9, 03:27 UTC · Sep 9, 2026VulnerabilityExploitedCVE-2026-85880 CVE-2026-81963 CVE-2026-69730+27 · 3 reads

2026-011: Critical Vulnerabilities in SAP Kernel and NetWeaver Message Server

SAP patched two critical flaws, OVERPASS (CVE-2026-44756, CVSS 10.0) and S4GET (CVE-2026-58240), allowing unauthenticated attackers to execute OS commands on SAP hosts.

CERT-EU AdvisoriesSep 9, 00:00 UTC · Sep 9, 2026VulnerabilityCVE-2026-44756 CVE-2026-582404 · 1 read

SAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary Code

SAP patched a CVSS 10.0 unauthenticated RCE flaw (CVE-2026-58231) in Commerce Cloud's Data Hub Adapter, plus three critical flaws in NetWeaver and Manufacturing.

The Hacker NewsAug 12, 07:31 UTC · Aug 12, 2026VulnerabilityCVE-2026-58231 CVE-2026-44772 CVE-2026-34265+11 · 1 read

Related CVEs

by mentions

CVE-2026-44756<1%10.0
Unauthenticated buffer overflow in SAP Kernel Extended Passport (EPP) processing
published Sep 8, 2026SAP Kernel (Extended Passport Protocol (EPP) processing library)
CVE-2026-58240<1%9.8
Unauthenticated Component Registration Flaw in SAP NetWeaver Message Server
published Sep 8, 2026SAP NetWeaver Message Server
CVE-2026-76969<1%9.4
Unauthenticated Credential Theft and Tenant Data Tampering in SAP @sap/cds-mtxs
published Sep 8, 2026SAP @sap/cds-mtxs npm library (CAP multitenancy service; exploitable when used in multitenant CAP applications with extensib
CVE-2026-66768<1%9.0
Trust Level Policy Bypass Enables RCE in SAP GUI for Java
published Sep 8, 2026SAP GUI for Java
CVE-2026-81963<1%7.8
Local Privilege Escalation via Link Following in Windows Update Stack
published Sep 8, 2026Microsoft Windows 11KEV
CVE-2026-85880<1%7.8
Heap-Based Buffer Overflow in Windows ALPC Enables Local Privilege Escalation
published Sep 8, 2026Microsoft Windows 10KEV
CVE-2026-69590<1%9.8
Unauthenticated RCE in Microsoft Windows Routing and Remote Access Service (RRAS)
published Sep 8, 2026Microsoft Windows Routing and Remote Access Service (RRAS)
CVE-2026-34265<1%9.8
SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corruption
published Aug 11, 2026
CVE-2026-628933%9.8
Pre-auth use-after-free RCE in Microsoft Windows Deployment Services (WDS)
published Aug 11, 2026microsoft Windows 10
CVE-2026-44772—
published —

Appears with

SAPvendor · 5
SAP NetWeaverproduct · 4
SAP S/4HANAproduct · 3
SAPorganization · 2
Onapsisorganization · 2
SAP NetWeaver Message Serverproduct · 2
SAP Cloud Application Programming Modelproduct · 2
Windows 11product · 1
Ivantivendor · 1
CERT-EUvendor · 1
Zero Day Initiativeorganization · 1
Action1vendor · 1
Microsoftvendor · 1
Zero Day Initiativevendor · 1
Fortravendor · 1
SAP GUI for Javaproduct · 1

Entities are extracted by the model from each article. First seen Aug 12, 2026, last mentioned Sep 9, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.