2026-011: Critical Vulnerabilities in SAP Kernel and NetWeaver Message Server
SAP patched two critical flaws, OVERPASS (CVE-2026-44756, CVSS 10.0) and S4GET (CVE-2026-58240), allowing unauthenticated attackers to execute OS commands on SAP hosts.
On SAP's September 2026 Security Patch Day, SAP released Security Notes 3747649 and 3759472 fixing two critical unauthenticated remote vulnerabilities found by Onapsis. CVE-2026-44756 ('OVERPASS', CVSS 10.0) is a memory corruption flaw in Extended Passport (EPP) deserialisation in the SAP Kernel; CVE-2026-58240 ('S4GET', CVSS 9.8) is a missing authentication check in the NetWeaver Message Server that lets attackers register as trusted cluster nodes. Successful exploitation of either can yield OS command execution as the SAP service account, leading to full system and business data compromise, and CERT-EU urges immediate patching. No in-the-wild exploitation is reported.
- CVE-2026-44756 (CVSS 10.0) is unauthenticated memory corruption in SAP EPP processing leading to OS command execution
- CVE-2026-58240 (CVSS 9.8) lets unauthenticated attackers promote themselves to trusted nodes in the Message Server
- S4GET is reachable through the same public port used by SAP GUI clients, limiting firewall mitigation
- Fixes are SAP Security Notes 3747649 and 3759472; CERT-EU strongly recommends immediate patching
- Organizations
- Onapsis Research LabsCERT-EU
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-44756 | Unauthenticated buffer overflow in SAP Kernel Extended Passport (EPP) processing | 10.0 | <1% | ||
| CVE-2026-58240 | Unauthenticated Component Registration Flaw in SAP NetWeaver Message Server | 9.8 | <1% |
From the original article
2 min read at cert.europa.eu
On 8 September 2026, as part of its September Security Patch Day, SAP released Security Notes addressing two critical vulnerabilities affecting a broad range of SAP products[3]. The most severe, CVE-2026-44756 (CVSS 10. 0), is a memory corruption vulnerability in SAP Extended Passport (EPP) processing, nicknamed "OVERPASS" by the Onapsis Research Labs (ORL), which discovered and responsibly disclosed it[3].
cert.europa.eu
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.