SAP warns of maximum severity 'OVERPASS' kernel vulnerability
SAP's September 2026 patches fix maximum-severity kernel flaw CVE-2026-44756 (OVERPASS), letting unauthenticated attackers execute commands on 10,000+ internet-facing SAP systems.
SAP's September 2026 Patch Tuesday addresses 20 vulnerabilities, headlined by CVE-2026-44756, a buffer overflow in the Extended Passport Protocol (EPP) library of the SAP Kernel dubbed OVERPASS by Onapsis researchers. Unauthenticated attackers can gain administrative command execution via SAP Internet Communication Manager; Onapsis counted more than 10,000 internet-facing SAP systems. SAP also fixed CVE-2026-58240 (S4GET), a critical missing-authentication flaw in the NetWeaver Message Server enabling unauthenticated remote code execution as <sid>adm. Since November 2021, CISA has added 14 SAP flaws to its actively exploited list, three abused by ransomware gangs.
- CVE-2026-44756 (OVERPASS) is a buffer overflow in EPP allowing unauthenticated administrative RCE via ICM.
- Over 10,000 internet-facing SAP systems exposed, per Onapsis fingerprinting.
- CVE-2026-58240 (S4GET) allows unauthenticated RCE across the cluster via the SAP GUI port.
- CISA has listed 14 SAP flaws as actively exploited since 2021, three used by ransomware gangs.
- Vendors
- SAP
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-44756 | Unauthenticated buffer overflow in SAP Kernel Extended Passport (EPP) processing | 10.0 | <1% | ||
| CVE-2026-58231 | Unauthenticated Code Injection RCE in SAP Commerce Cloud | 10.0 | <1% | PoC | |
| CVE-2026-58240 | Unauthenticated Component Registration Flaw in SAP NetWeaver Message Server | 9.8 | <1% |
From the original article
2 min read at bleepingcomputer.com
SAP has addressed 20 vulnerabilities across multiple products in its September 2026 security updates, including a maximum-severity memory corruption flaw in the SAP Kernel code. [...]
By Sergiu Gatlan · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.