SAP patches critical 'OVERPASS' flaw that hands attackers full control of business servers

Key points

• SAP fixed 20 vulnerabilities on 9 September 2026, including a maximum-severity kernel bug tracked as CVE-2026-44756 and nicknamed OVERPASS.
• Security firm Onapsis estimates more than 10,000 internet-facing SAP systems run the vulnerable component.
• A second critical flaw, CVE-2026-58240 in the SAP NetWeaver Message Server, lets attackers with no credentials execute commands across every server in a cluster.
• Last month SAP patched CVE-2026-58231 in Commerce Cloud, which was exploited in the wild days later.
• Since November 2021, the US Cybersecurity and Infrastructure Security Agency has added 14 SAP flaws to its list of actively exploited vulnerabilities, three of them abused by ransomware gangs.

SAP has released fixes for 20 security flaws in its September 2026 patch batch, and two of them are the kind that keep enterprise defenders up at night.

The headline bug is called OVERPASS. It sits deep in the SAP Kernel, the core software that runs the company's business applications for payroll, finance, supply chains and more. SAP is used by 99 of the world's 100 largest companies, so the reach is enormous.

OVERPASS, formally CVE-2026-44756, is a buffer overflow. In plain terms, an attacker sends the server more data than a memory area was built to hold, and the extra data spills over and gets executed as instructions. The bug lives in the Extended Passport Protocol library and can be reached over the SAP Internet Communication Manager, the piece of software that connects SAP systems to the wider internet using web protocols.

An attacker with no account on the system can use it to run any command they like, with administrator rights, on the underlying server.

Researchers at Onapsis, who reported the flaw, say a conservative sweep of the public internet found more than 10,000 unique SAP web interfaces reachable from anywhere. "That figure is conservative," Onapsis CTO JP Perez-Etchegoyen said, noting the scan misses SAP Web Dispatcher deployments that hide their identity from scanners.

What is the second critical bug?

It is a missing-authentication flaw in the SAP NetWeaver Message Server, tracked as CVE-2026-58240 and nicknamed S4GET. Attackers who reach the port can take over every application server in a cluster without a password.

The Message Server is the traffic cop between SAP application servers. Onapsis researcher Pablo Artuso, who found the bug, said the awkward part is that the vulnerable port is the same one every SAP GUI client uses to log in.

"It cannot be firewalled away without breaking the end-user logon," Artuso wrote. A successful attack gives full remote code execution as the operating system user that runs SAP itself, on every server in the cluster. No credentials, no certificate, no prior foothold needed.

Is any of this being exploited already?

Not these two, as far as anyone has said publicly. But the pattern is not encouraging.

Last month SAP fixed another maximum-severity bug, CVE-2026-58231, in its Commerce Cloud e-commerce platform. Threat intelligence firm Defused spotted attackers exploiting it in the wild within days of the patch landing, as first reported by BleepingComputer.

The US Cybersecurity and Infrastructure Security Agency, the federal body that tracks bugs being used in real attacks, has added 14 SAP flaws to its Known Exploited Vulnerabilities catalogue since November 2021. Three of those were picked up by ransomware crews, which is the criminal business of encrypting a victim's files and demanding payment to unlock them.

What should SAP customers do now?

Apply the September 2026 SAP Security Patch Day updates, prioritising OVERPASS and S4GET. Both carry the highest possible severity score.

Ordinary customers of companies that run SAP have nothing to install themselves. The risk sits with the enterprises whose payroll, ordering and HR systems depend on it. If those get taken over, downstream effects (delayed pay, leaked personal data, halted shipments) can reach individuals fast.