SAP fixed 20 security vulnerabilities in multiple products as part of its September 2026 updates, including a critical-severity vulnerability in SAP Kernel code that, when successfully exploited, allows arbitrary commands to be executed on SAP servers with administrative privileges and grants full control over SAP processes and the business data associated with them.
The vulnerability is tracked as CVE-2026-44756 and was named OVERPASS by Onapsis researchers. It is caused by a traditional buffer overflow flaw in the Extended Passport Protocol, or EPP, processing library. The affected component can be reached through the SAP Internet Communication Manager, the networking component in SAP Application Server that connects SAP systems, including SAP NetWeaver Application Server, to the internet over HTTP, HTTPS, and SMTP.
Potential Exposure
Onapsis estimated that more than 10,000 internet-connected SAP systems use the affected component, making them potential targets for attacks exploiting the vulnerability. JP Perez-Etchegoyen, chief technology officer at Onapsis, said a targeted search using high-fidelity fingerprints identified more than 10,000 unique IP addresses exposing an SAP interface accessible through the public internet.
Perez-Etchegoyen noted that this figure is an estimate and is conservative because it includes systems accessible only over HTTP and does not fully detect SAP Web Dispatcher. This component acts as an intermediary for backend systems, but it does not necessarily expose a clear identifying indicator in its root path, making it difficult to detect through large-scale scanning operations.
Second Vulnerability in NetWeaver Message Server
SAP’s updates also addressed CVE-2026-58240 in SAP NetWeaver Message Server, a critical flaw caused by missing authentication that Onapsis researchers named S4GET. Exploiting it could allow an unauthenticated attacker to access the entire SAP cluster and remotely execute malicious payloads and arbitrary commands over the network.
According to Onapsis security researcher Pablo Artuso, the vulnerability is exploited through the same public port used by SAP GUI clients to connect, meaning that the port cannot be blocked by a firewall without affecting user logins. Exploitation also requires no credentials, certificate, or pre-existing misconfiguration, and successful exploitation could result in remote command execution under the <sid>adm account, the operating-system account that runs SAP, on application servers within the cluster.
Why Does This Matter?
The OVERPASS vulnerability combines exposure through a component that handles external connections with a high impact that extends to command execution with administrative privileges. S4GET adds a different risk path because it does not depend on prior authentication and could affect the entire application cluster. SAP operators should therefore prioritize reviewing the September 2026 updates, identifying exposed systems, and verifying access settings for the ICM and Message Server components.
This follows SAP’s remediation the previous month of a critical-severity vulnerability in Commerce Cloud tracked as CVE-2026-58231, which Defused said was actively exploited days after it was patched. Since November 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has also added a total of 14 vulnerabilities in SAP products to its Known Exploited Vulnerabilities catalog, including three vulnerabilities used by ransomware gangs.