SAP S/4HANA

SAP September 2026 Patch Day: OVERPASS (CVE-2026-44756, CVSS 10.0) and S4GET (CVE-2026-58240, CVSS 9.8): two unauthenticated pre-auth RCE flaws in shared SAP kernel components reachable through ports that cannot be firewalled without breaking normal SAP GUI/RFC use

SAP's 8 September 2026 Security Patch Day fixed CVE-2026-44756 ("OVERPASS", CVSS 10.0) and CVE-2026-58240 ("S4GET", CVSS 9.8), both discovered and responsibly disclosed by Onapsis Research Labs, both remotely exploitable pre-authentication (CERT-EU, advisory 2026-011, 2026-09-09). OVERPASS is a memory-corruption flaw in the SAP kernel's processing of the Extended Passport, a tracing structure attached to requests and parsed before session authentication; because the handling code is shared, the flaw is reachable via three independent unauthenticated routes: the Internet Communication Manager/Web Dispatcher (HTTP/HTTPS, Fiori/WebGUI/APIs), the SAP Dispatcher (the SAP GUI logon protocol), and RFC connections between systems, each with a single crafted request corrupting memory to reach arbitrary OS command execution as the account that owns the SAP installation (Onapsis, 2026-09-08; CERT-EU, 2026-09-09). Onapsis's own internet-wide fingerprinting found more than 10,000 unique internet-facing IPs presenting an SAP web interface, a figure it calls conservative since it structurally undercounts the SAP Web Dispatcher, which returns no distinguishing banner (Onapsis, 2026-09-08). S4GET is a distinct logic flaw in the SAP NetWeaver Message Server (kernel lines 9.16-9.20, native to S/4HANA and S/4HANA Cloud Private Edition) reachable through the same public port every SAP GUI client connects to: a crafted packet gets an arbitrary IP address accepted as a trusted internal node, and the Message Server propagates that false trust across the cluster so the Gateway admits the attacker as internal and the attacker can invoke RFC-callable programs to reach code execution as <sid>adm on every application server: "exploitation requires no credentials, no certificate, and no pre-existing misconfiguration" (Onapsis, 2026-09-08). Because the flaw abuses the Gateway's trust-membership decision rather than its ACLs, the standard secinfo/reginfo/ms/acl_info hardening does not intercept it (Onapsis, 2026-09-08). Neither flaw is confirmed exploited as of publication, but Onapsis notes SAP patches have historically been reverse-engineered into working exploits within 72 hours, as happened with the RECON vulnerability (CVE-2020-6287), and that window keeps shrinking with AI-assisted tooling, while a comparable pre-auth SAP disclosure (CVE-2025-31324) became 2025's most-exploited CVE by Mandiant's count (Onapsis, 2026-09-08). Fixed via SAP Security Note 3747649 (OVERPASS, a single kernel patch closing all three routes, with an HTTP-only interim workaround in Note 3756304) and Note 3759472 (S4GET, kernel patch levels 9.16 PL100/9.18 PL32/9.19 PL17/9.20 PL7).

Triage: an SAP Gateway admitting a connection as internal from an IP address that is not a known application server, followed by invocations of RFC-callable programs from it, is the S4GET trust-abuse pattern Onapsis describes (Onapsis, 2026-09-08).

CVE-2026-34263 and CVE-2026-34260: SAP Commerce Cloud unauthenticated code injection and S/4HANA Enterprise Search SQL injection (May 2026 Patch Day)

SAP released its May 2026 security notes on 2026-05-12, among them Note 3733064 for CVE-2026-34263 in SAP Commerce Cloud (HY_COM 2205, COM_CLOUD 2211 and 2211-JDK21) and Note 3724838 for CVE-2026-34260 in SAP S/4HANA's Enterprise Search for ABAP (SAP_BASIS 751 to 758 and 816), both rated Critical at CVSS 9.6 (SAP, May 2026); Onapsis counts seventeen new and updated notes, three of them HotNews (Onapsis, 2026-05-12). CVE-2026-34263 stems from improper Spring Security configuration that lets an unauthenticated user perform malicious input injection resulting in arbitrary server-side code execution (EUVD-2026-29372); Onapsis traces it to an overly permissive security configuration with improper rule ordering that allows malicious configuration upload and code injection (Onapsis, 2026-05-12), and SAP's vector requires user interaction (SAP, May 2026). CVE-2026-34260 lets an authenticated attacker inject SQL through user-controlled input that the application concatenates into its queries (EUVD-2026-29371); the affected code only allows reading data, so confidentiality and availability are affected but integrity is not (Onapsis, 2026-05-12). The cycle's third HotNews note, 3747787 of 2026-04-30, covers the variant of the Shai-Hulud worm that injected malicious code into SAP Cloud Application Programming npm packages available for two to four hours on 2026-04-29 (Onapsis, 2026-05-12). SAP makes no mention of exploitation in the wild (SecurityWeek, 2026-05-12).