SAP OVERPASS, unauthenticated memory-corruption RCE in shared SAP kernel Extended Passport processing (CVSS 10.0), September 2026 Patch Day

SAP September 2026 Patch Day: OVERPASS (CVE-2026-44756, CVSS 10.0) and S4GET (CVE-2026-58240, CVSS 9.8), two unauthenticated pre-auth RCE flaws in shared SAP kernel components reachable through ports that cannot be firewalled without breaking normal SAP GUI/RFC use

SAP's 8 September 2026 Security Patch Day fixed CVE-2026-44756 ("OVERPASS", CVSS 10.0) and CVE-2026-58240 ("S4GET", CVSS 9.8), both discovered and responsibly disclosed by Onapsis Research Labs, both remotely exploitable pre-authentication (CERT-EU, advisory 2026-011, 2026-09-09). OVERPASS is a memory-corruption flaw in the SAP kernel's processing of the Extended Passport, a tracing structure attached to requests and parsed before session authentication; because the handling code is shared, the flaw is reachable via three independent unauthenticated routes: the Internet Communication Manager/Web Dispatcher (HTTP/HTTPS, Fiori/WebGUI/APIs), the SAP Dispatcher (the SAP GUI logon protocol), and RFC connections between systems, each with a single crafted request corrupting memory to reach arbitrary OS command execution as the account that owns the SAP installation (Onapsis, 2026-09-09; CERT-EU, 2026-09-09). Onapsis's own internet-wide fingerprinting found more than 10,000 unique internet-facing IPs presenting an SAP web interface, a figure it calls conservative since it structurally undercounts the SAP Web Dispatcher, which returns no distinguishing banner (Onapsis, 2026-09-09). S4GET is a distinct logic flaw in the SAP NetWeaver Message Server (kernel lines 9.16-9.20, native to S/4HANA and S/4HANA Cloud Private Edition) reachable through the same public port every SAP GUI client connects to: a crafted packet gets an arbitrary IP address accepted as a trusted internal node, and the Message Server propagates that false trust across the cluster so the Gateway admits the attacker as internal and the attacker can invoke RFC-callable programs to reach code execution as <sid>adm on every application server: "exploitation requires no credentials, no certificate, and no pre-existing misconfiguration" (Onapsis, 2026-09-09). Because the flaw abuses the Gateway's trust-membership decision rather than its ACLs, the standard secinfo/reginfo/ms/acl_info hardening does not intercept it. Neither flaw is confirmed exploited as of publication, but Onapsis notes SAP patches have historically been reverse-engineered into working exploits within 72 hours, as happened with the RECON vulnerability (CVE-2020-6287), and that window keeps shrinking with AI-assisted tooling, while a comparable pre-auth SAP disclosure (CVE-2025-31324) became 2025's most-exploited CVE by Mandiant's count (Onapsis, 2026-09-09). Fixed via SAP Security Note 3747649 (OVERPASS, a single kernel patch closing all three routes, with an HTTP-only interim workaround in Note 3756304) and Note 3759472 (S4GET, kernel patch levels 9.16 PL100/9.18 PL32/9.19 PL17/9.20 PL7).

Triage: an SAP Gateway admitting a connection as internal from an IP address that is not a known application server, followed by invocations of RFC-callable programs from it, is the S4GET trust-abuse pattern Onapsis describes (Onapsis, 2026-09-09).