SAP OVERPASS CVSS 10.0 Bug: CVE-2026-44756 Patched

Elias Virtanen
September 12, 2026
14 min read

SAP’s September 8, 2026 Security Patch Day landed with a number that made enterprise security teams sit up: a perfect 10.0 on the Common Vulnerability Scoring System. The flaw, tracked as CVE-2026-44756 and nicknamed “OVERPASS” by Onapsis Research Labs, sits in the SAP kernel’s handling of Extended Passport data, a tracing structure attached to nearly every request that hits an SAP system before a user is even authenticated. A second critical bug, CVE-2026-58240 (“S4GET,” CVSS 9.8), strips away the authentication check on the SAP NetWeaver Message Server. Together, the two vulnerabilities headline a patch batch of 19 new SAP security notes, and researchers are already comparing them to RECON and 10KBLAZE, two of the most damaging SAP disclosures of the last decade.

For an ERP platform that still runs payroll, procurement, and manufacturing logistics at most of the Fortune 500, a CVSS 10.0 unauthenticated remote code execution bug is not an abstract risk. It’s the kind of finding that pulls CISOs out of vacation and onto emergency patch calls. This article breaks down what OVERPASS and S4GET actually do, who is exposed, how they stack up against past SAP disasters, and what security teams should do in the next 30 days.

Don’t miss new tech stories on Google

Add Tech Insider once in the Google app and our stories appear in your news suggestions.

What is SAP OVERPASS (CVE-2026-44756)?

OVERPASS is a memory corruption vulnerability in how the SAP kernel processes Extended Passport (EPP) data. EPP is a lightweight tracing structure that SAP systems attach to incoming requests so that performance and transaction monitoring tools can follow a call across distributed application servers. Crucially, EPP is parsed by a shared kernel library before any session authentication takes place, according to CERT-EU’s September 9, 2026 advisory. That detail is what makes the bug so dangerous: an attacker never needs valid credentials to reach the vulnerable code path.

The root cause, per RedRays’ technical breakdown, is missing boundary validation on attacker-controlled length fields inside the EPP header and payload. When the kernel deserializes a crafted EPP structure with malformed length values, it performs unsafe memory operations, resulting in a heap or stack-level buffer overflow. SAP’s own note describes the outcome more conservatively as “undefined behavior and abnormal program termination,” but multiple independent researchers say the flaw can be pushed further, toward arbitrary operating system command execution under the SAP installation account, typically the privileged <sid>adm user.

Because EPP handling lives in a shared kernel library, the bug is reachable through three separate unauthenticated paths: the Internet Communication Manager and SAP Web Dispatcher (the components serving Fiori, WebGUI, and OData traffic), the classic SAP Dispatcher used by SAP GUI clients, and RFC connections between SAP systems, including trusted RFC links. An attacker only needs network access to one of these ports and a single crafted request to attempt exploitation. SecurityWeek’s coverage of the note calls it a critical vulnerability that could trigger unsafe memory behavior purely from an externally supplied request, with no login step involved.

What is SAP S4GET (CVE-2026-58240)?

S4GET targets a different piece of core SAP plumbing: the NetWeaver Message Server, the component responsible for routing traffic and managing connections between application server instances in an SAP landscape. According to Onapsis’s advisory, the Message Server includes functionality that lets internal components register themselves with the central instance, and the code path that handles that registration is missing an authentication check. An attacker with plain network access to the Message Server port can send a crafted registration message and have the server accept it as legitimate.

NIST’s National Vulnerability Database entry describes the impact bluntly: an unauthenticated attacker could exploit this weakness to register an unauthorized component and potentially perform unauthorized actions within the application environment. In practice, that means an attacker could insert a rogue application server into the SAP landscape, intercept or redirect inter-server traffic, hijack client sessions mid-transaction, or trigger denial of service across the whole system. Onapsis’s advisory states plainly: “The official fix is available now in SAP Security Note 3759472, and applying it should be an immediate priority for every affected organization.”

Affected SAP products and versions

Both flaws hit components that ship inside nearly every modern SAP deployment, from ECC systems still running on older NetWeaver kernels to current S/4HANA environments. SAP addressed OVERPASS in Security Note 3747649 and S4GET in Security Note 3759472. The affected version ranges are broad enough that most SAP customers running on-premises or hybrid infrastructure will need to check their kernel patch level.

The version spread matters because it spans both legacy and current kernel lines. KERNEL 9.16 through 9.20 are the builds typically found underneath recent S/4HANA installations, which means organizations that assumed newer platforms were inherently safer from this class of bug are just as exposed as those running older ECC systems on 7.x kernels.

The CVSS vectors, decoded

OVERPASS carries a CVSS 3.0 vector of AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, per RedRays. Translated, that means the vulnerability is reachable over the network (AV:N), requires low attack complexity (AC:L), needs no privileges (PR:N) and no user interaction (UI:N), and can change scope beyond the vulnerable component (S:C), causing high impact to confidentiality, integrity, and availability alike. That scope-change flag is part of why the score hits the maximum 10.0: successful exploitation doesn’t just crash the EPP-handling process, it can cascade into full compromise of the surrounding SAP environment.

S4GET’s vector is consistent with AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, the same network-reachable, zero-privilege, zero-interaction profile, but without the scope change, which is why it lands at 9.8 rather than a perfect score. Both numbers sit at the very top of the severity scale that CVSS defines, a bracket normally reserved for vulnerabilities researchers expect to be weaponized quickly once technical details circulate.

Is there active exploitation or public proof-of-concept code?

As of publication, no vendor or CERT has confirmed in-the-wild exploitation of either OVERPASS or S4GET, and no public proof-of-concept exploit code has surfaced. That is a meaningfully different situation from Microsoft’s September 2026 Patch Tuesday, where two Windows zero-days were already being exploited before patches shipped. Still, CERT-EU’s advisory treats OVERPASS as imminently exploitable given its unauthenticated, network-facing, shared-library nature, and several vendor write-ups describe working internal exploitation scenarios without releasing weaponized code publicly.

That gap between disclosure and exploitation is historically short for SAP bugs of this caliber. When RECON was disclosed in July 2020, researchers warned that scanning activity for vulnerable systems began within days of the advisory. Security teams should assume the same clock is now running for OVERPASS and S4GET, particularly once reverse engineers start diffing the patched kernel binaries against the vulnerable ones, a common way exploit details leak even without an official PoC release.

How OVERPASS and S4GET compare to RECON and 10KBLAZE

SAP security researchers keep reaching for the same two historical comparisons: RECON, the CVE-2020-6287 flaw in SAP NetWeaver AS Java that let unauthenticated attackers create admin users, and 10KBLAZE, a set of configuration weaknesses in SAP Gateway and Message Server access control lists disclosed in 2019 that also enabled remote, unauthenticated compromise. Both incidents triggered emergency government bulletins at the time, and both are still cited in SAP hardening guides six and seven years later.

The parallels with OVERPASS and S4GET are direct: unauthenticated network reach, no user interaction required, and full-system compromise as the realistic worst case. The differences are more about mechanism than severity. RECON was a business-logic and configuration weakness in a web component; OVERPASS is a memory-safety bug baked into a shared kernel library used across multiple protocols. 10KBLAZE largely exploited default or overly permissive access control lists on the Message Server; S4GET is a genuine missing-authentication defect in the registration code itself, meaning even a well-configured ACL doesn’t fully close the gap without the patch.

Who discovered these SAP vulnerabilities?

Onapsis Research Labs is credited with discovering and responsibly disclosing OVERPASS, and CERT-EU explicitly names the firm in its advisory. Onapsis, a Boston-based SAP and Oracle security specialist that has been involved in disclosing SAP vulnerabilities since well before RECON, also published its own dedicated threat advisory for S4GET, with Kudelski Security’s research team publishing independent technical analysis of the same bug. RedRays, a separate SAP-focused security research firm, published detailed technical write-ups of both notes shortly after the September 8 patch day, adding kernel-level exploitation detail that SAP’s own notes intentionally leave out to slow down attacker reverse engineering.

Why enterprise ERP security keeps landing at CVSS 10.0

SAP systems were designed in an era when internal corporate networks were treated as inherently trusted. Protocols like RFC and the Message Server registration handshake assumed that anything with network access to the port was a legitimate internal system. Three decades later, flat internal networks, cloud migrations, third-party integrations, and remote access have quietly erased that assumption, but a lot of core SAP protocol design hasn’t caught up. That mismatch is exactly what OVERPASS and S4GET exploit: code written for a trusted-network world, now reachable from far less trusted places.

It’s also why September’s Patch Day landed the same week as a separate wave of maximum-severity bugs across the industry. Check Point shipped emergency fixes on September 9 for two CVSS 9.8 VPN gateway flaws in its Security Gateway and Spark Firewall products. N-able issued a hotfix for a CVSS 10.0 pre-authentication remote code execution bug in its N-central endpoint management platform, which the company said had already seen exploitation attempts. Microsoft’s own September Patch Tuesday, released the same week, fixed a record 974 vulnerabilities, 113 of them critical, including two Windows zero-days already being exploited in the wild. Security teams patching SAP this month are doing so against a backdrop of one of the busiest, highest-severity patch cycles in recent memory.

Which industries face the most exposure

SAP’s install base skews toward exactly the sectors that regulators and critical-infrastructure frameworks care most about. Manufacturing, energy and utilities, financial services, healthcare and pharmaceutical logistics, retail supply chains, and government agencies all rely heavily on SAP ERP, HANA, and NetWeaver-based systems for core operations, from payroll and procurement to plant-floor manufacturing execution. Several advisories tied to this Patch Day specifically flag NIS2-regulated organizations in the European Union, since NIS2 compliance obligations extend to exactly the kind of core operational technology and IT infrastructure that SAP kernels and Message Servers underpin.

The risk isn’t evenly distributed, though. Organizations that run SAP behind well-segmented networks, with Web Dispatcher and Message Server ports locked down to trusted internal ranges, face a materially lower practical risk than those with SAP components exposed to broader internal networks or, worse, reachable from the internet through misconfigured reverse proxies. Attack surface scans in the days following disclosure are likely to become the fastest way for defenders to learn whether they’re exposed, since SAP’s own Security Notes don’t include a built-in exposure check.

Recommended mitigation steps

SAP, CERT-EU, and independent researchers converge on a consistent set of priorities for the next few weeks. The most important point across every advisory: patching is the only complete fix, because both flaws live in shared, core protocol-handling code rather than in an optional module that can simply be disabled.

• Apply SAP Security Note 3747649 to upgrade the affected kernel and Web Dispatcher builds and close CVE-2026-44756 (OVERPASS).
• Apply SAP Security Note 3759472 to patch the Message Server code path and close CVE-2026-58240 (S4GET).
• Prioritize internet-facing and DMZ-hosted SAP components first, since those carry the highest realistic exploitation risk.
• Restrict network exposure of ICM, Web Dispatcher, Dispatcher, RFC, and Message Server ports to trusted internal ranges until patching completes across the landscape.
• Review Message Server and Gateway access control lists to ensure only known SAP hosts can register as application servers.
• Enable and monitor logging on Web Dispatcher, ICM, and Message Server for malformed EPP headers or unexpected component registrations.
• Rotate credentials for technical users and database connection accounts if any compromise indicators are found post-patch.
• Test kernel and Web Dispatcher upgrades in QA environments first, but compress the change-management timeline given the severity.

Other vulnerabilities in the September 2026 SAP Patch Day

OVERPASS and S4GET are the headline entries, but SAP’s September Patch Day addressed 19 security notes in total, per SAP’s own Patch Day summary and vendor roundups from Cyberpress and RedRays. The remaining 17 notes cover a mix of missing authorization checks in specific SAP applications, information disclosure issues, and lower-severity denial-of-service bugs across modules including SAP BusinessObjects and HANA add-ons, a fairly typical monthly spread, except for the two outliers sitting at the very top of the severity scale.

Market and vendor impact

SAP’s stock and enterprise reputation have weathered critical vulnerability disclosures before without lasting damage, largely because switching costs off SAP ERP are enormous and most large customers view patching as a routine, if urgent, operational task rather than a reason to change vendors. That said, the disclosure adds momentum to a security services market that has grown steadily around SAP-specific risk: Onapsis, RedRays, SecurityBridge, and Pathlock have all built businesses specifically around SAP vulnerability research, attack surface monitoring, and virtual patching for systems that can’t be immediately upgraded. Expect a fresh wave of demand for SAP-focused attack surface management tools and managed detection services in the weeks following this disclosure, similar to the bump those vendors saw after RECON in 2020.

Managed service providers and SAP hosting partners are also facing pressure to demonstrate patch compliance quickly, since many enterprise customers now write SAP-specific SLAs into managed hosting contracts following earlier high-profile SAP incidents. A slow patch rollout across a hosting provider’s shared infrastructure could expose dozens of tenant organizations simultaneously, which is part of why CERT-EU’s language pushes for immediate remediation rather than the usual 30-to-90-day patch window many organizations budget for ERP changes.

Historical context: a pattern of maximum-severity SAP bugs

OVERPASS is the latest in a recurring pattern of SAP vulnerabilities that hit or approach the maximum CVSS score roughly once every 18 to 24 months. RECON in July 2020 was the first widely publicized case to reach a perfect 10.0 and prompted emergency advisories from national cybersecurity agencies. In 2022, the ICMAD vulnerabilities, including CVE-2022-22536, again hit CVSS 10.0 in SAP’s Internet Communication Manager, a component closely related to the one implicated in OVERPASS. Each incident has followed a similar arc: disclosure, an emergency patch, a scramble across enterprise IT departments, and a subsequent surge in scanning activity from both researchers and opportunistic attackers looking for unpatched systems left exposed for months or years afterward.

What makes the 2026 disclosure distinct is timing: it landed in the same week as Microsoft’s largest-ever Patch Tuesday, a record-setting Chrome zero-day fix, and emergency patches from Check Point, N-able, and SonicWall. Security teams are facing what amounts to a five-vendor, maximum-severity patching sprint in a single week, a workload concentration that stretches even well-resourced vulnerability management programs thin.

Predictions: what happens next

Based on how comparable SAP disclosures have played out historically, several outcomes look likely over the coming months.

• Expect scanning activity targeting exposed SAP Web Dispatcher and Message Server ports to spike within one to two weeks of disclosure, mirroring the pattern seen after RECON and ICMAD.
• A working proof-of-concept for OVERPASS is likely to circulate in security research circles, and possibly semi-publicly, within 60 to 90 days, based on the typical gap between SAP kernel bug disclosure and public exploitation research.
• National CERTs beyond CERT-EU will likely issue their own advisories or add one or both CVEs to exploited-vulnerability tracking lists if any exploitation is confirmed.
• SAP-focused security vendors, including Onapsis and RedRays, will likely see increased enterprise inquiries for SAP attack surface monitoring and virtual patching services through the fourth quarter of 2026.
• A meaningful share of affected organizations, particularly those running older ECC systems on legacy kernel branches, will still have unpatched systems six months from now, following the same slow-patch pattern documented after RECON and 10KBLAZE.

What SAP administrators should do this week

The practical starting point is an inventory check: confirm exactly which kernel and Web Dispatcher versions are running across production, QA, development, and disaster-recovery landscapes, since patch coverage needs to extend to all of them, not just the systems handling live transactions. From there, apply SAP Security Notes 3747649 and 3759472 in accelerated change windows, and use network segmentation as a stopgap for any system that can’t be patched immediately. Given that both bugs require no authentication and no user interaction, network-layer controls, restricting who can even reach the vulnerable ports, offer the most reliable short-term risk reduction while patches roll out.

Security teams should also treat this disclosure as a prompt to review broader SAP hardening practices, not just these two CVEs. RFC trust relationships, Gateway access control lists, and default service accounts are all areas that historically get overlooked between major disclosures, and the same weaknesses that made 10KBLAZE and RECON so damaging tend to resurface in slightly different forms with each new SAP kernel-level bug.

This disclosure follows a string of maximum-severity enterprise bugs in 2026, including Microsoft’s September 2026 Patch Tuesday, the CVSS 10.0 Cisco FMC bug exploited by Sandworm and Qilin, and the VMware vCenter bug hit by Babuk ransomware. Security teams looking to structure their response can also follow a 12-step CISA KEV patch workflow or review how GitLab’s CVSS 9.4 bug was exploited within 48 hours of disclosure for a sense of how fast attackers now move.

Frequently Asked Questions

What is SAP OVERPASS?
OVERPASS is the nickname for CVE-2026-44756, a CVSS 10.0 memory corruption vulnerability in how the SAP kernel processes Extended Passport (EPP) data. It allows unauthenticated attackers with network access to potentially execute arbitrary operating system commands on affected SAP systems.

What is SAP S4GET?
S4GET is the nickname for CVE-2026-58240, a CVSS 9.8 missing-authentication vulnerability in the SAP NetWeaver Message Server that lets unauthenticated attackers register unauthorized components and interfere with internal SAP traffic.

Are OVERPASS and S4GET being actively exploited?
As of this writing, no vendor or CERT organization has confirmed active exploitation in the wild for either vulnerability, and no public proof-of-concept exploit code has been released. Researchers still recommend treating both as imminently exploitable given their unauthenticated, network-reachable nature.

Which SAP versions are affected by these vulnerabilities?
OVERPASS affects SAP kernel versions including KRNL64NUC 7.22/7.22EXT, KRNL64UC 7.22 through 8.04, KERNEL 7.22 through 9.20, and SAP Web Dispatcher 9.16 through 9.20. S4GET affects KERNEL versions 9.16 through 9.20, which are commonly used in current S/4HANA deployments.

How do I patch these SAP vulnerabilities?
Apply SAP Security Note 3747649 for OVERPASS and SAP Security Note 3759472 for S4GET through the standard SAP Software Download Center or your SAP Solution Manager patch process. Both require a kernel or Web Dispatcher upgrade rather than a configuration-only fix.

How do OVERPASS and S4GET compare to the 2020 RECON vulnerability?
All three share an unauthenticated, network-reachable exploitation path and can lead to full system compromise. RECON exploited a business-logic flaw in SAP NetWeaver AS Java, while OVERPASS is a memory-safety bug in the shared SAP kernel and S4GET is a missing-authentication defect in the Message Server, making them mechanically different but comparably severe.

Who discovered the OVERPASS and S4GET vulnerabilities?
Onapsis Research Labs is credited by CERT-EU with discovering and responsibly disclosing OVERPASS. Onapsis also published its own advisory for S4GET, alongside independent technical analysis from Kudelski Security and RedRays.

What industries are most at risk from these SAP vulnerabilities?
Manufacturing, energy and utilities, financial services, healthcare, retail, and government agencies face the highest exposure, since these sectors rely heavily on SAP ERP and NetWeaver-based systems for core operations, and several advisories specifically flag organizations subject to the EU’s NIS2 compliance framework.