Summary
- SAP's September security release fixes CVE-2026-44756, rated 10.0, and CVE-2026-58240, rated 9.8.
- Both flaws can be reached without authentication and can lead to operating-system command execution on affected SAP infrastructure.
- Onapsis says it has not observed exploitation in the wild, but the vulnerabilities reach systems underpinning core enterprise processes.
SAP has patched two critical vulnerabilities capable of giving unauthenticated attackers operating-system-level control over affected enterprise systems, including infrastructure supporting finance, supply chains, human resources, and other core business processes.
SAP released fixes for CVE-2026-44756 and CVE-2026-58240 as part of its September Security Patch Day. The vulnerabilities carry CVSS scores of 10.0 and 9.8 respectively and were discovered by Onapsis Research Labs through coordinated disclosure with SAP.
CERT-EU issued an advisory warning that both can be exploited remotely without authentication. Researcher Onapsis said it had not observed active exploitation in the wild as of its latest update.
The maximum-severity CVE-2026-44756, named OVERPASS by Onapsis, is a memory-corruption vulnerability in the way the SAP kernel processes Extended Passport data. Extended Passports are used for tracing calls through distributed SAP environments and are handled early in a connection, before normal user authentication and authorisation controls take effect.
According to Onapsis, the affected kernel functionality is reachable through multiple routes, including web-facing SAP services, SAP GUI connections, and Remote Function Call links between systems. Successful exploitation can result in arbitrary operating-system commands running under the account that owns the SAP installation.
SAP Security Note 3747649 provides the vendor fix. The affected kernel code is used across a broad range of SAP technology, including systems supporting S/4HANA, ERP and Business Suite environments, NetWeaver Application Server ABAP, Web Dispatcher, BW/4HANA, Enterprise Portal, PI/PO, and Solution Manager.
The second vulnerability, CVE-2026-58240, affects the SAP NetWeaver Message Server and has been named S4GET by Onapsis. It is a missing authentication check affecting SAP 9.x kernel lines used by S/4HANA and S/4HANA Cloud Private Edition, with other ABAP-based products potentially in scope.
The Message Server coordinates application servers in an SAP cluster and handles SAP GUI logon routing. Onapsis says the flaw can allow an unauthenticated attacker with network access to abuse trust relationships within the cluster and ultimately execute code with the operating-system privileges used by SAP. SAP Security Note 3759472 contains the fix.
The vulnerabilities are significant less because of their headline severity scores than because of where affected systems sit in large organisations. SAP platforms frequently underpin financial accounting, procurement, manufacturing, logistics, payroll, customer records, and other processes whose integrity has direct operational and financial consequences.
A compromise at the SAP host level therefore has a different risk profile from a flaw confined to a peripheral web application. Control of the underlying system can expose business data and credentials, create opportunities for lateral movement, and allow manipulation of applications that organisations rely on to execute transactions and maintain operational records.
The affected attack paths also complicate reliance on network position alone. OVERPASS can be reached through several communication layers, while S4GET targets a service that legitimate SAP clients need to contact. Internet-facing systems represent the clearest remote exposure, but internal SAP estates remain relevant where an attacker has already established access elsewhere on a corporate network.
That distinction is important for organisations that assess vulnerability priority primarily through external exposure. An SAP system behind the perimeter can still be operationally critical and reachable by large populations of internal users, integrated applications, contractors, or connected systems.
SAP’s September Patch Day contained 22 new and updated Security Notes, including five HotNews Notes and six rated High Priority. CVE-2026-44756 and CVE-2026-58240 stand apart because both remove authentication as an obstacle to attacks reaching central SAP infrastructure.
There is currently no public evidence of either vulnerability being exploited in active attacks. That leaves the story at the exposure and remediation stage rather than an incident response stage. Given the breadth of SAP estates and the operational sensitivity of kernel patching, however, the practical challenge is identifying every affected system and moving fixes through production environments before that evidence position changes.
