SAP NetWeaver Application Server ABAP

SAP September 2026 Patch Day: OVERPASS (CVE-2026-44756, CVSS 10.0) and S4GET (CVE-2026-58240, CVSS 9.8), two unauthenticated pre-auth RCE flaws in shared SAP kernel components reachable through ports that cannot be firewalled without breaking normal SAP GUI/RFC use

SAP's 8 September 2026 Security Patch Day fixed CVE-2026-44756 ("OVERPASS", CVSS 10.0) and CVE-2026-58240 ("S4GET", CVSS 9.8), both discovered and responsibly disclosed by Onapsis Research Labs, both remotely exploitable pre-authentication (CERT-EU, advisory 2026-011, 2026-09-09). OVERPASS is a memory-corruption flaw in the SAP kernel's processing of the Extended Passport, a tracing structure attached to requests and parsed before session authentication; because the handling code is shared, the flaw is reachable via three independent unauthenticated routes: the Internet Communication Manager/Web Dispatcher (HTTP/HTTPS, Fiori/WebGUI/APIs), the SAP Dispatcher (the SAP GUI logon protocol), and RFC connections between systems, each with a single crafted request corrupting memory to reach arbitrary OS command execution as the account that owns the SAP installation (Onapsis, 2026-09-09; CERT-EU, 2026-09-09). Onapsis's own internet-wide fingerprinting found more than 10,000 unique internet-facing IPs presenting an SAP web interface, a figure it calls conservative since it structurally undercounts the SAP Web Dispatcher, which returns no distinguishing banner (Onapsis, 2026-09-09). S4GET is a distinct logic flaw in the SAP NetWeaver Message Server (kernel lines 9.16-9.20, native to S/4HANA and S/4HANA Cloud Private Edition) reachable through the same public port every SAP GUI client connects to: a crafted packet gets an arbitrary IP address accepted as a trusted internal node, and the Message Server propagates that false trust across the cluster so the Gateway admits the attacker as internal and the attacker can invoke RFC-callable programs to reach code execution as <sid>adm on every application server: "exploitation requires no credentials, no certificate, and no pre-existing misconfiguration" (Onapsis, 2026-09-09). Because the flaw abuses the Gateway's trust-membership decision rather than its ACLs, the standard secinfo/reginfo/ms/acl_info hardening does not intercept it (Onapsis, 2026-09-09). Neither flaw is confirmed exploited as of publication, but Onapsis notes SAP patches have historically been reverse-engineered into working exploits within 72 hours, as happened with the RECON vulnerability (CVE-2020-6287), and that window keeps shrinking with AI-assisted tooling, while a comparable pre-auth SAP disclosure (CVE-2025-31324) became 2025's most-exploited CVE by Mandiant's count (Onapsis, 2026-09-09). Fixed via SAP Security Note 3747649 (OVERPASS, a single kernel patch closing all three routes, with an HTTP-only interim workaround in Note 3756304) and Note 3759472 (S4GET, kernel patch levels 9.16 PL100/9.18 PL32/9.19 PL17/9.20 PL7).

Triage: an SAP Gateway admitting a connection as internal from an IP address that is not a known application server, followed by invocations of RFC-callable programs from it, is the S4GET trust-abuse pattern Onapsis describes (Onapsis, 2026-09-09).

SAP Commerce Cloud CVE-2026-58231: an unauthenticated request to a vulnerable Data Hub Adapter endpoint reaches arbitrary code execution (CVSS 10.0), and the fix needs a rebuild and redeploy

SAP's August 2026 Security Patch Day of 2026-08-11 released 28 new security notes plus one GitHub security advisory, with two updates to previously released notes (SAP SE, 2026-08-11); Onapsis, counting the cycle its own way, puts it at thirty-three notes including five HotNews and nine High Priority (Onapsis Research Labs, 2026-08-11). The one that changes an exposure picture rather than a patch schedule is CVE-2026-58231, carried by SAP Security Note 3771065 at CVSS 10.0: an improper-authorization flaw in the Data Hub Adapter of SAP Commerce Cloud. Onapsis, which worked with SAP on eleven of the notes in this cycle, describes the cause as insufficient authorization checks combined with insufficient input validation, and the outcome as arbitrary code execution with compromise of internal components (Onapsis Research Labs, 2026-08-11). The reason this ranks above a routine critical: Commerce Cloud runs online stores, so in analyst judgement the vulnerable component is likely to be reachable from the internet, and the score's pre-auth, no-interaction profile means reaching it takes a crafted request rather than a foothold.

Remediation for this one is not a patch install. Onapsis states customers must patch to the fixed Commerce Cloud release levels referenced in the note and then rebuild and redeploy the updated version, and that the interim exposure reduction available today is an IP filter set restricting access to the vulnerable endpoint (Onapsis Research Labs, 2026-08-11). Any organisation whose change process treats "SAP note applied" as equivalent to "fixed" will record this as remediated while the storefront is still reachable. SAP Security Note 3773203 is SAP's fix for CVE-2026-42945 (CVSS 8.1) as a potential buffer overflow affecting Commerce Cloud public-cloud deployments with NGINX (SAP SE, 2026-08-11), and it is consumed the same way, by building and deploying the Commerce Cloud application (Onapsis, 2026-08-11).

Further notes Onapsis classes as HotNews matter to different estates. CVE-2026-44772 (CVSS 9.9, Note 3765948) and CVE-2026-44758 (CVSS 9.1, Note 3758900) are code-injection flaws in SAP Manufacturing Integration and Intelligence reaching arbitrary command execution on the underlying host; Onapsis states the lower score on the second reflects a higher privilege requirement. The two remedies are not the same: for Note 3758900 (CVE-2026-44758) the patch removes the vulnerable servlet component outright, while for Note 3765948 (CVE-2026-44772) the servlet stays in place and customers must additionally configure and maintain a new "Secure Transformer" system property naming the hosts allowed to serve XSL files to it (Onapsis Research Labs, 2026-08-11). CVE-2026-34265 (CVSS 9.8, Note 3714806) is, in analyst judgement, the one to weigh against internal network exposure rather than internet exposure. Onapsis describes it: "Logical errors in DIAG protocol parsing allow an unauthenticated attacker to generate memory corruptions" in the Application Server ABAP kernel, with potential disclosure of sensitive system information or a crash of the instance (Onapsis Research Labs, 2026-08-11). The affected kernel list spans KRNL64NUC/KRNL64UC and KERNEL builds from 7.22 through 9.19 (SAP SE, 2026-08-11); since DIAG is the SAP GUI presentation protocol, the affected listener is, in analyst judgement, one that ordinarily faces user workstations. Rounding out the High Priority set, CVE-2026-58243 (CVSS 8.8, Note 3772411) covers the SQL Console in SAP ABAP Developer Tools, where support for host expressions inside SQL statements let a low-privileged authenticated user run database operations they should not reach (Onapsis Research Labs, 2026-08-11).

On patch day NCSC-CH rated the exploitation status unknown (NCSC-CH, 2026-08-11); three days later Defused reported exploitation attempts against the Data Hub Adapter flaw at its honeypots (BleepingComputer, 2026-08-14), and on 2026-08-15 NCSC-NL relayed Defused's report of attackers actively scanning for vulnerable systems (NCSC-NL, 2026-08-15). The Data Hub Adapter flaw demands action ahead of the normal SAP patch cadence: it is an unauthenticated, no-interaction path to code execution, disclosed with a CVSS 10.0 and a documented interim network control. Detection concepts are ordinary but specific: in web and reverse-proxy access logs, surface requests to the Data Hub Adapter endpoint from source addresses outside the integration ranges that legitimately feed it, and treat any such request that precedes an unexplained child process under the Commerce Cloud application account as an incident rather than an anomaly. In analyst judgement, legitimate Data Hub imports come from a known set of integration sources, so the source address and the calling identity, not the request body, are the useful filter. On the ABAP side, Onapsis names a crash of the instance among the possible outcomes (Onapsis Research Labs, 2026-08-11); in analyst judgement, a DIAG-parsing memory-corruption attempt would therefore surface as work-process crashes or short dumps clustered on one instance rather than as an authentication event.

Builds on: CVE-2026-42945, NGINX Open Source / Plus / F5 WAF products: 18-year-old heap buffer overflow in…

SAP July 2026 Security Patch Day: three CVSS ≥9.1 flaws in NetWeaver AS ABAP, Approuter and Commerce Cloud, two reachable without authentication

SAP's July 2026 Security Patch Day (14 July) carries three critical flaws NCSC Switzerland's Cyber Security Hub relayed directly to Swiss constituents, none with reported exploitation at publication (NCSC-CH, 2026-07-14; Onapsis Research Labs, 2026-07-14). CVE-2026-44747 (CVSS 9.9) is a memory-corruption flaw in the SAP NetWeaver Application Server ABAP kernel; SecurityWeek characterises successful exploitation as allowing an attacker to access and modify data and cause system unavailability, and SAP's only interim workaround (disabling the affected ICF nodes) is impractical because it breaks SAP GUI for HTML, so patching the kernel is the real mitigation (SecurityWeek, 2026-07-14). CVE-2026-27690 (CVSS 9.1) is an HTTP request-smuggling flaw in SAP Approuter's non-Cloud-Foundry deployments: an unauthenticated request desynchronises the request/response stream on a shared front-end, a primitive usable to poison or hijack another user's request. CVE-2026-44761 (CVSS 9.1) is a hardcoded sample OAuth2 credential in SAP Commerce Cloud; any customer that ran SAP's own documented sample configuration and never rotated the shipped secret exposes a publicly-known credential an unauthenticated attacker can use to obtain a valid OCC-API access token (Onapsis Research Labs, 2026-07-14).