SAP has released security updates for 20 vulnerabilities across several products. The patches include a maximum-severity SAP kernel vulnerability that could allow attackers to take full control of affected systems.
The critical flaw, tracked as CVE-2026-44756, affects the Extended Passport Protocol processing library. Security researchers at Onapsis discovered the issue and named it OVERPASS.
OVERPASS enables administrative code execution
OVERPASS results from a classic buffer overflow weakness in the SAP Kernel code.
An unprivileged attacker could exploit the flaw to execute arbitrary commands with administrative rights. Therefore, a successful attack could compromise SAP processes and expose sensitive business data.
The vulnerability can be reached through SAP Internet Communication Manager, also known as ICM. This networking component connects SAP NetWeaver Application Server systems to the internet.
ICM supports several common protocols, including HTTP, HTTPS, and SMTP. As a result, vulnerable SAP systems exposed online may face a significant risk.
Onapsis estimates that more than 10,000 internet-facing SAP systems use the affected component. However, the actual number may be considerably higher.
Researchers identified these systems using detailed fingerprints associated with publicly accessible SAP web interfaces. Their count only covers systems reachable over HTTP.
In addition, SAP Web Dispatcher systems may hide the identity of their backend infrastructure. Internet-wide scanners can therefore struggle to detect them.
SAP also fixes critical S4GET flaw
SAP’s September updates also address another critical vulnerability tracked as CVE-2026-58240.
Onapsis named this vulnerability S4GET. It affects the SAP NetWeaver Message Server and results from missing authentication controls.
An unauthenticated attacker could exploit the flaw to access an entire SAP system cluster. The attacker could then send malicious payloads and execute arbitrary commands across the network.
S4GET is particularly dangerous because it targets the same public port used by SAP GUI clients. Administrators cannot simply block that port without disrupting normal user logins.
Moreover, an attacker does not need credentials, certificates, or an existing configuration error. Successful exploitation provides remote code execution as the operating system account that runs SAP.
This account, commonly identified as <sid>adm, has extensive privileges. Therefore, an attacker could potentially execute commands on every application server within the cluster.
SAP systems remain attractive targets
The latest patches arrive shortly after SAP addressed another maximum-severity security flaw.
In August, the company fixed CVE-2026-58231 in SAP Commerce Cloud. Security researchers detected active exploitation only days after SAP released the patch.
SAP vulnerabilities remain valuable targets because many large organizations depend on the company’s software. Attackers may use compromised systems to steal business data, disrupt operations, or deploy ransomware.
Since November 2021, the U.S. Cybersecurity and Infrastructure Security Agency has added 14 SAP vulnerabilities to its catalog of known exploited flaws. Ransomware groups exploited at least three of them.
SAP provides software and services to 99 of the world’s 100 largest companies. The German company also reported more than €36 billion in revenue during its 2025 financial year.
Because of the possible impact, administrators should prioritize the latest updates. In particular, organizations should patch the OVERPASS SAP kernel vulnerability and the S4GET flaw as soon as possible.
0 responses to “SAP Patches Maximum-Severity OVERPASS Kernel Vulnerability”