Full Report
SAP has addressed 20 vulnerabilities across multiple products in its September 2026 security updates, including a maximum-severity memory corruption flaw in the SAP Kernel code. [...]
Analysis Summary
# Vulnerability: OVERPASS & S4GET Critical Flaws in SAP Kernel and NetWeaver
## CVE Details
- **CVE ID:** CVE-2026-44756 (OVERPASS), CVE-2026-58240 (S4GET)
- **CVSS Score:** 10.0 (Maximum Severity)
- **CWE:** CWE-120 (Buffer Overflow) for OVERPASS; Missing Authentication for S4GET
## Affected Systems
- **Products:** SAP Kernel, SAP NetWeaver Application Server (Message Server), SAP Web Dispatcher.
- **Versions:** Multiple versions using the Extended Passport Protocol (EPP) library and SAP NetWeaver Message Server.
- **Configurations:**
- **OVERPASS:** Systems reachable via SAP Internet Communication Manager (ICM) using HTTP, HTTPS, and SMTP.
- **S4GET:** Systems where the public port used by SAP GUI clients is accessible.
## Vulnerability Description
- **OVERPASS (CVE-2026-44756):** A classic buffer overflow in the Extended Passport Protocol (EPP) processing library within the SAP Kernel code. It allows unprivileged actors to execute arbitrary commands with administrative privileges.
- **S4GET (CVE-2026-58240):** A logic flaw involving missing authentication in the SAP NetWeaver Message Server. Attackers can bypass security controls via the standard SAP GUI client port to gain Full Remote Code Execution (RCE) as the `<sid>adm` user across the entire cluster.
## Exploitation
- **Status:** Not currently reported as exploited in the wild (Note: A related flaw, CVE-2026-58231, was recently flagged as actively exploited).
- **Complexity:** Low (S4GET requires no credentials, certificates, or specific misconfigurations).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** High (Full compromise of business data).
- **Integrity:** High (Ability to execute arbitrary commands and payloads).
- **Availability:** High (Full control over underlying SAP processes and system clusters).
## Remediation
### Patches
- SAP has addressed these flaws in the **September 2026 Security Updates**. Administrators should immediately apply the latest Kernel patches and NetWeaver updates provided via the SAP Support Portal.
### Workarounds
- **OVERPASS:** Restrict access to the ICM networking component; however, patching is the only definitive fix.
- **S4GET:** The flaw cannot be easily firewalled without breaking end-user logon functionality, making immediate patching critical.
## Detection
- **Indicators of Compromise:** Monitor for unusual administrative activity originating from the SAP GUI port or ICM interfaces. Watch for unexpected child processes spawned by SAP kernel binaries.
- **Detection methods and tools:**
- Use high-fidelity fingerprints to identify Internet-facing SAP web interfaces.
- Audit SAP NetWeaver Message Server logs for unauthenticated access attempts.
## References
- **Vendor Advisory:** SAP Security Patch Day – September 2026
- **Onapsis Research (OVERPASS):** hxxps[://]onapsis[.]com/blog/sap-overpass-remediation/
- **Onapsis Research (S4GET):** hxxps[://]onapsis[.]com/blog/s4get-cve-2026-58240-sap-message-server-threat-advisory/
- **NVD Entry (CVE-2026-44756):** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2026-44756
- **NVD Entry (CVE-2026-58240):** hxxps[://]nvd[.]nist[.]gov/vuln/detail/CVE-2026-58240