SAP’s September 2026 Security Patch Day addressed 20 vulnerabilities, led by two critical flaws that together allow unauthenticated attackers to take full control of exposed SAP systems. The first, CVE-2026-44756 — dubbed OVERPASS by Onapsis security researchers — is a classic buffer overflow in the Extended Passport Protocol (EPP) processing library inside the SAP Kernel, earning a maximum CVSS score of 10.0. Exploitation runs through SAP’s Internet Communication Manager (ICM), the networking layer that connects SAP NetWeaver Application Servers to the internet over HTTP, HTTPS, and SMTP. A successful attack lets an unprivileged, unauthenticated attacker execute arbitrary commands with administrative privileges, leading to full compromise of SAP processes and business data. Onapsis estimates more than 10,000 internet-facing IP addresses present an exploitable SAP web interface — and that count is conservative, since SAP Web Dispatcher hosts are structurally difficult for internet-wide scanners to fingerprint.
The second critical flaw patched this cycle is CVE-2026-58240, named S4GET, a missing-authentication vulnerability in the SAP NetWeaver Message Server. It operates on the same network port that every SAP GUI client uses, so it cannot be firewalled without breaking end-user logon. Exploitation requires no credentials, no certificate, and no pre-existing misconfiguration; a successful attack achieves full remote code execution as the OS-level SAP user across every application server in the cluster. CISA has added 14 SAP security flaws to its Known Exploited Vulnerabilities catalog since 2021, and SAP vulnerabilities have been used by ransomware gangs — organizations running unpatched SAP should treat these patches as urgent.
How to check if you’re affected
Affected products are SAP NetWeaver Application Server for ABAP, SAP Kernel (all versions without the September 2026 patch), and SAP NetWeaver Message Server. SAP administrators should log into the SAP Support Portal, apply the September 2026 Security Patch Day notes, and verify the updated SAP Kernel version is active. Organizations using internet-connected ICM or Message Server endpoints should prioritize patching immediately; if patching cannot happen within 24 hours, consider temporarily restricting external access to those ports.