2026-011: Critical Vulnerabilities in SAP Kernel and NetWeaver Message Server
SAP patched two critical flaws, OVERPASS (CVE-2026-44756, CVSS 10.0) and S4GET (CVE-2026-58240), allowing unauthenticated attackers to execute OS commands on SAP hosts.
On SAP's September 2026 Security Patch Day, SAP released Security Notes 3747649 and 3759472 fixing two critical unauthenticated remote vulnerabilities found by Onapsis. CVE-2026-44756 ('OVERPASS', CVSS 10.0) is a memory corruption flaw in Extended Passport (EPP) deserialisation in the SAP Kernel; CVE-2026-58240 ('S4GET', CVSS 9.8) is a missing authentication check in the NetWeaver Message Server that lets attackers register as trusted cluster nodes. Successful exploitation of either can yield OS command execution as the SAP service account, leading to full system and business data compromise, and CERT-EU urges immediate patching. No in-the-wild exploitation is reported.
- CVE-2026-44756 (CVSS 10.0) is unauthenticated memory corruption in SAP EPP processing leading to OS command execution
- CVE-2026-58240 (CVSS 9.8) lets unauthenticated attackers promote themselves to trusted nodes in the Message Server
- S4GET is reachable through the same public port used by SAP GUI clients, limiting firewall mitigation
- Fixes are SAP Security Notes 3747649 and 3759472; CERT-EU strongly recommends immediate patching
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-44756 | Unauthenticated buffer overflow in SAP Kernel Extended Passport (EPP) processing CVE-2026-44756 is a critical (CVSS 10.0) memory-safety flaw — a classic buffer overflow (CWE-120) — in the Extended Passport Protocol (EPP) processing library of SAP Kernel, the core runtime underlying SAP NetWeaver components (SAP's advisories tie the issue to SAP Kernel and the NetWeaver Message Server). An unauthenticated remote attacker can trigger it by sending a crafted network request containing a malformed EPP header to a system that processes EPP traffic. The malformed header causes undefined behavior and abnormal program termination, and SAP's maximum-severity rating plus vendor coverage of the flaw indicate it can enable unauthenticated remote code execution with high impact on confidentiality, integrity, and availability. Any organization running the affected SAP Kernel/NetWeaver components — essentially typical ABAP-stack SAP deployments — is exposed until patched. No public proof-of-concept is known, the flaw is not in CISA KEV, EPSS estimates only a 0.3% chance of exploitation within 30 days (25th percentile), and fixes shipped in SAP's September 2026 Security Patch Day. Do: Apply the SAP Kernel and NetWeaver Message Server fixes released in SAP's September 2026 Security Patch Day (per the 2026-011 advisory covering this flaw), since specific fixed version numbers are not listed in the available data. As interim mitigation, restrict network access to SAP kernel and message-server services to trusted internal networks and identify any SAP instances exposed to the internet. Check SAP's advisory for the exact patch levels applicable to your kernel releases and prioritize externally reachable systems. | 10.0 | <1% |
| mass≈100,000+ SAP systems plausibly affected (EPP/kernel ships with virtually all ABAP-stack NetWeaver deployments; public scans have historically shown tens of… | ||
| CVE-2026-58240 | Unauthenticated Component Registration Flaw in SAP NetWeaver Message Server SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components when they register with the service (CWE-308). An unauthenticated attacker with network access to the affected service can send a crafted registration request to add or impersonate an application server component. Once registered, the attacker can potentially perform unauthorized actions within the SAP application environment, resulting in a high impact on confidentiality, integrity, and availability — reflected in the critical CVSS 9.8 score. Any organization running SAP NetWeaver deployments that rely on the Message Server is affected; the source data does not specify exact affected version ranges. There is no evidence of active exploitation, no public proof-of-concept, and the issue is not in CISA KEV, with EPSS assigning only a ~0.3% 30-day exploitation probability; a fix shipped in SAP's September 2026 Security Patch Day (a release that also patched other critical flaws, including the separately reported 'OVERPASS' SAP Kernel issue). Do: Apply the SAP NetWeaver Message Server fix from the September 2026 SAP Security Patch Day (referenced as advisory 2026-011) as a priority, since the flaw is unauthenticated and network-triggerable; check SAP's portal for the corrected builds applicable to your release, as no specific version numbers were provided in the source data. Until patching, restrict network access to the Message Server (typically TCP 36xx, e.g., 3600) to trusted application server hosts and internal networks, and verify no message server listener is reachable from the internet. Monitor SAP security notes for updates, as no public exploit exists today. | 9.8 | <1% |
| largetens of thousands of SAP NetWeaver installations plausibly affected (Message Server is a standard component of every NetWeaver stack, with a smaller subset… |
Full article514 words · extracted from cert.europa.eu · click to collapse
Release Date: 09-09-2026 13:07:59
History:
- 09/09/2026 --- v1.0 -- Initial publication.
Summary
On 8 September 2026, as part of its September Security Patch Day, SAP released Security Notes addressing two critical vulnerabilities affecting a broad range of SAP products [1][3]. The most severe, CVE-2026-44756 (CVSS 10.0), is a memory corruption vulnerability in SAP Extended Passport (EPP) processing, nicknamed "OVERPASS" by the Onapsis Research Labs (ORL), which discovered and responsibly disclosed it [2][3]. The second, CVE-2026-58240 (CVSS 9.8), nicknamed "S4GET", is a missing authentication check in the SAP NetWeaver Message Server [3][6].
Both are remotely exploitable without authentication. According to the reporting researchers, successful exploitation of either can result in arbitrary operating system command execution under the account that owns the SAP installation, leading to full compromise of the affected system and the business data it holds [2][6].
CERT-EU strongly recommends applying SAP Security Notes 3747649 and 3759472 as soon as possible [1].
Technical Details
CVE-2026-44756 - "OVERPASS" (CVSS 10.0)
CVE-2026-44756 is a memory corruption vulnerability in the SAP Kernel library that processes the Extended Passport (EPP), addressed by SAP Security Note 3747649 [1][4]. SAP's CVE record states that boundary validation is missing during the deserialisation of EPP data, and that an unauthenticated attacker can send a crafted network request containing a malformed EPP header, potentially resulting in undefined behaviour and abnormal program termination, with a high impact on confidentiality, integrity, and availability [2][3].
Onapsis, which reported the vulnerability, assesses that successful exploitation allows a remote attacker to execute arbitrary operating system commands on the SAP host with SAP administrative privileges, resulting in full compromise of the underlying SAP business data and processes [2].
CVE-2026-58240 - "S4GET" (CVSS 9.8)
CVE-2026-58240 is a missing authentication check in the SAP NetWeaver Message Server (component BC-CST-MS), addressed by SAP Security Note 3759472 [1][5]. The Message Server does not sufficiently validate the authenticity of internal application server components during registration. Consequently, an unauthenticated attacker with network access can register unauthorised components and potentially perform unauthorised actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system [3][5].
Onapsis, which also reported this vulnerability, states that an attacker can promote themselves to a trusted node inside an SAP cluster, that the Message Server propagates that trust to every application server in the cluster, and that a successful attack yields remote code execution as the operating-system user that runs SAP [6]. Onapsis notes the flaw is reachable through the same public port that SAP GUI clients connect to, which cannot be firewalled without breaking end-user logon [6].
Affected Products
CVE-2026-44756 -- affected versions [1]:
- KRNL64NUC 7.22, 7.22EXT
- KRNL64UC 7.22, 7.22EXT, 7.53, 8.04
- KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.16, 9.18, 9.19, 9.20
- WEBDISP 9.16, 9.18, 9.19, 9.20
CVE-2026-58240 -- affected versions [1]:
- KERNEL 9.16, 9.18, 9.19, 9.20
Recommendations
CERT-EU strongly recommends following SAP Security Note 3747649 (CVE-2026-44756) and SAP Security Note 3759472 (CVE-2026-58240) to update the affected products to the relevant versions as soon as possible [1].
References
[1] https://support.sap.com/en/my-support/knowledge-base/security-notes-news/september-2026.html
[2] https://onapsis.com/blog/sap-overpass-remediation/
[3] https://onapsis.com/blog/sap-security-patch-day-september-2026/
[4] https://www.cve.org/CVERecord?id=CVE-2026-44756
[5] https://www.cve.org/CVERecord?id=CVE-2026-58240
[6] https://onapsis.com/blog/s4get-cve-2026-58240-sap-message-server-threat-advisory/
Text extracted automatically; images, tables and formatting may be missing. Original: https://cert.europa.eu/publications/security-advisories/2026-011/