SAP has patched 20 vulnerabilities in its September 2026 update, headlined by 'OVERPASS,' a maximum-severity memory corruption flaw. The vulnerability allows unprivileged attackers to gain full administrative control over SAP hosts.

  • A maximum-severity flaw dubbed 'OVERPASS' (CVE-2026-44756) was found in the SAP Kernel.
  • Over 10,000 internet-facing SAP systems are estimated to be exposed to this vulnerability.
  • A second critical flaw, 'S4GET' (CVE-2026-58240), allows remote code execution without authentication.

In its September 2026 security cycle, SAP addressed 20 distinct vulnerabilities across its product suite. The most alarming of these is 'OVERPASS' (CVE-2026-44756), a memory corruption flaw located within the SAP Kernel code. Discovered by researchers at Onapsis, the vulnerability is rooted in a classic buffer overflow weakness within the Extended Passport Protocol (EPP) processing library.

If successfully exploited, this flaw allows unprivileged threat actors to execute arbitrary commands on vulnerable SAP hosts with full administrative privileges. This essentially grants attackers total control over the underlying SAP processes and sensitive business data. The attack vector is the SAP Internet Communication Manager (ICM), the critical networking component that bridges the SAP system to the internet via HTTP, HTTPS, and SMTP.

Read Also:23andMe to Pay $18M Settlement Over Massive Genetic Data Breach

Why This Matters

BozokMedia analysis shows that the systemic nature of this vulnerability creates a massive risk surface for global commerce. Given that SAP provides services to 99 of the 100 largest companies worldwide, a breach of this magnitude could lead to catastrophic data leaks for the world's most powerful corporations. Onapsis CTO JP Perez-Etchegoyen noted that while 10,000 unique IP addresses were identified, this is a conservative estimate due to the structural difficulty of scanning SAP Web Dispatchers.

The ability to execute remote code as the OS-level user without any credentials makes this one of the most dangerous flaws discovered this year.

Additionally, SAP patched 'S4GET' (CVE-2026-58240), a critical authentication failure in the SAP NetWeaver Message Server. This flaw is particularly dangerous because it utilizes the same public port used by SAP GUI clients, meaning it cannot be blocked by a firewall without simultaneously breaking legitimate user access.

Vulnerability CVE ID Impact Root Cause
OVERPASS CVE-2026-44756 Full Administrative Access Buffer Overflow (EPP)
S4GET CVE-2026-58240 Remote Code Execution Missing Authentication

The historical context of SAP security is concerning. Since November 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added 14 SAP flaws to its list of actively exploited vulnerabilities. Some of these have already been weaponized by sophisticated ransomware gangs to infiltrate corporate networks.

Did You Know?: SAP's financial footprint is massive, reporting revenues exceeding €36 billion in FY2025, underscoring why it is a primary target for state-sponsored hackers.

Frequently Asked Questions

Q1: How can organizations protect themselves from the OVERPASS flaw?
Organizations must immediately apply the September 2026 security updates provided by SAP to patch the kernel vulnerability.

Q2: Why is S4GET harder to mitigate than other flaws?
Because it operates on the standard login port, disabling the port to stop the attack would prevent all authorized users from accessing the system.