SAP patches critical 'OVERPASS' flaw that hands attackers full control of business servers
A buffer overflow in the SAP Kernel, plus a second critical bug in NetWeaver Message Server, could let unauthenticated attackers run commands on more than 10,000 exposed systems.
Key points
- SAP fixed 20 vulnerabilities on 9 September 2026, including a maximum-severity kernel bug tracked as CVE-2026-44756 and nicknamed OVERPASS.
- Security firm Onapsis estimates more than 10,000 internet-facing SAP systems run the vulnerable component.
- A second critical flaw, CVE-2026-58240 in the SAP NetWeaver Message Server, lets attackers with no credentials execute commands across every server in a cluster.
- Last month SAP patched CVE-2026-58231 in Commerce Cloud, exploited in the wild days later.
- CISA has added 14 SAP flaws to its known-exploited list since November 2021, three of them abused by ransomware gangs.
SAP has released fixes for 20 security flaws in its September 2026 patch batch, and two of them are the kind that keep enterprise defenders up at night.
The headline bug is called OVERPASS. It sits deep in the SAP Kernel, the core software running the company's business applications for payroll, supply chains and HR. SAP serves 99 of the world's 100 largest companies, so the reach is enormous.
OVERPASS, formally CVE-2026-44756, is a buffer overflow. An attacker sends the server more data than a memory area was built to hold; the extra data spills over and gets executed as instructions. The bug lives in the Extended Passport Protocol library and can be reached over the SAP Internet Communication Manager, the component that connects SAP systems to the internet via web protocols.
No account needed. An attacker can run any command they like, with administrator rights, on the underlying server.
Researchers at Onapsis, who reported the flaw, say a sweep of the public internet found more than 10,000 unique SAP web interfaces reachable from anywhere. "That figure is conservative," Onapsis CTO JP Perez-Etchegoyen said, noting the scan misses SAP Web Dispatcher deployments that hide their identity from scanners.
What is the second critical bug?
It's a missing-authentication flaw in the SAP NetWeaver Message Server, tracked as CVE-2026-58240 and nicknamed S4GET. Attackers who reach the port can take over every application server in a cluster without a password.
The Message Server is the traffic cop between SAP application servers. Onapsis researcher Pablo Artuso, who found the bug, identified an awkward constraint: the vulnerable port is the same one every SAP GUI client uses to log in.
"It cannot be firewalled away without breaking the end-user logon," Artuso wrote. A successful attack gives full remote code execution as the operating system user that runs SAP itself, on every server in the cluster. No credentials, no certificate, no prior foothold needed.
Is any of this being exploited already?
Not these two, as far as anyone has said publicly. But the pattern isn't encouraging.
When SAP fixed another maximum-severity bug last month, CVE-2026-58231 in its Commerce Cloud platform, threat intelligence firm Defused spotted attackers exploiting it within days of the patch landing, as first reported by BleepingComputer. We covered that flaw on 12 August in "SAP patches perfect-10 flaw in Commerce Cloud that let anyone run code".
CISA, the federal body that tracks bugs used in real attacks, has added 14 SAP flaws to its Known Exploited Vulnerabilities catalogue since November 2021. Three were picked up by ransomware crews, the criminal operators who encrypt victims' files and demand payment for the key.
What should SAP customers do now?
Apply the September 2026 SAP Security Patch Day updates; OVERPASS and S4GET both carry the highest possible severity score and should come first.
| Bug | ID | Component | Impact |
|---|---|---|---|
| OVERPASS | CVE-2026-44756 | SAP Kernel (EPP library) | Unauthenticated remote code execution as admin |
| S4GET | CVE-2026-58240 | NetWeaver Message Server | Unauthenticated code execution across cluster |
| Commerce Cloud RCE | CVE-2026-58231 | SAP Commerce Cloud | Exploited in the wild after August patch |
Ordinary customers of companies that run SAP have nothing to install themselves. The risk sits with enterprises running payroll, ordering and financial systems on top of it. If those get taken over, effects like delayed pay, leaked personal data and halted shipments can reach individuals fast.
The S4GET firewall problem is the detail worth watching: there's no network-level workaround, which means patch or exposure, with nothing in between.
