SAP September 2026 Patch Day: OVERPASS (CVE-2026-44756, CVSS 10.0) and S4GET (CVE-2026-58240, CVSS 9.8): two unauthenticated pre-auth RCE flaws in shared SAP kernel components reachable through ports that cannot be firewalled without breaking normal SAP GUI/RFC use
Two critical pre-auth SAP kernel flaws (CVSS 10.0 and 9.8) reach through the ports SAP GUI and RFC need; segmentation will not close them
Defender actions
- Apply SAP Security Notes 3747649 (OVERPASS) and 3759472 (S4GET) to every SAP kernel-based system now, internet-exposed systems first and then internal ones, because the affected components are commonly reachable through internal firewalls; public proof-of-concept exploits for both flaws have been available since 2026-09-15 in the SAPMAP toolkit, and Onapsis found over 10,000 internet-facing SAP interfaces.
Analysis
SAP's 8 September 2026 Security Patch Day fixed CVE-2026-44756 ("OVERPASS", CVSS 10.0) and CVE-2026-58240 ("S4GET", CVSS 9.8), both discovered and responsibly disclosed by Onapsis Research Labs, both remotely exploitable pre-authentication (CERT-EU, advisory 2026-011, 2026-09-09). OVERPASS is a memory-corruption flaw in the SAP kernel's processing of the Extended Passport, a tracing structure attached to requests and parsed before session authentication; because the handling code is shared, the flaw is reachable via three independent unauthenticated routes: the Internet Communication Manager/Web Dispatcher (HTTP/HTTPS, Fiori/WebGUI/APIs), the SAP Dispatcher (the SAP GUI logon protocol), and RFC connections between systems, each with a single crafted request corrupting memory to reach arbitrary OS command execution as the account that owns the SAP installation (Onapsis, 2026-09-08; CERT-EU, 2026-09-09). Onapsis's own internet-wide fingerprinting found more than 10,000 unique internet-facing IPs presenting an SAP web interface, a figure it calls conservative since it structurally undercounts the SAP Web Dispatcher, which returns no distinguishing banner (Onapsis, 2026-09-08). S4GET is a distinct logic flaw in the SAP NetWeaver Message Server (kernel lines 9.16-9.20, native to S/4HANA and S/4HANA Cloud Private Edition) reachable through the same public port every SAP GUI client connects to: a crafted packet gets an arbitrary IP address accepted as a trusted internal node, and the Message Server propagates that false trust across the cluster so the Gateway admits the attacker as internal and the attacker can invoke RFC-callable programs to reach code execution as <sid>adm on every application server: "exploitation requires no credentials, no certificate, and no pre-existing misconfiguration" (Onapsis, 2026-09-08). Because the flaw abuses the Gateway's trust-membership decision rather than its ACLs, the standard secinfo/reginfo/ms/acl_info hardening does not intercept it (Onapsis, 2026-09-08). Neither flaw is confirmed exploited as of publication, but Onapsis notes SAP patches have historically been reverse-engineered into working exploits within 72 hours, as happened with the RECON vulnerability (CVE-2020-6287), and that window keeps shrinking with AI-assisted tooling, while a comparable pre-auth SAP disclosure (CVE-2025-31324) became 2025's most-exploited CVE by Mandiant's count (Onapsis, 2026-09-08). Fixed via SAP Security Note 3747649 (OVERPASS, a single kernel patch closing all three routes, with an HTTP-only interim workaround in Note 3756304) and Note 3759472 (S4GET, kernel patch levels 9.16 PL100/9.18 PL32/9.19 PL17/9.20 PL7).
Triage: an SAP Gateway admitting a connection as internal from an IP address that is not a known application server, followed by invocations of RFC-callable programs from it, is the S4GET trust-abuse pattern Onapsis describes (Onapsis, 2026-09-08).
Cited evidence
A targeted search using high-fidelity fingerprints identifies more than 10,000 unique Internet-facing IP addresses presenting an SAP web interface reachable from the public Internet, and that figure is conservative.
Exploitation requires no credentials, no certificate, and no pre-existing misconfiguration. A successful attack yields full remote code execution as <sid>adm, the OS-level user that runs SAP, on every application server in the cluster.
On September 15th, a group of researchers publicly released an open-source SAP discovery and exploitation toolkit
Defenders should operate under the assumption that OVERPASS exploit PoCs have been made publicly available.
Public code establishes that a capability is available; an incident report establishes that someone used it against a victim.
Updates2
Onapsis Research Labs reports that on 2026-09-15 a group of researchers publicly released SAPMAP, an open-source (GPL 3.0) SAP discovery and exploitation toolkit that contains proof-of-concept exploits for both flaws, alongside ten standalone pre-authentication exploit files, post-authentication modules including an SAP ransomware proof of concept, and an automation loop that chains scanning, exploitation, enrichment and propagation (Onapsis, 2026-09-18). The maintainers first indicated that the OVERPASS exploits were being withheld, but Onapsis found them in the repository commits, says every clone since the original publication includes them and tells defenders to assume the OVERPASS proofs of concept are public (Onapsis, 2026-09-18). Onapsis had not observed threat actors using the toolkit when it wrote, and notes that public proof-of-concept releases can often jumpstart attack campaigns within days or weeks (Onapsis, 2026-09-18). Senthorus assesses on 2026-10-06 that packaging the capabilities together could reduce the preparation an intrusion needs, and separates that from evidence of use, which would need incident reporting (Senthorus, 2026-10-06). No source read reports exploitation of either flaw, and the fixes are unchanged: SAP Security Notes 3747649 and 3759472.
OVERPASS (CVE-2026-44756) is not limited to the 9.16 to 9.20 kernel lines: CERT-EU lists KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04 and 9.16 to 9.20, the 7.22 kernels (unicode and non-unicode), the 7.53 and 8.04 unicode kernels, and Web Dispatcher 9.16 to 9.20 as affected (CERT-EU, 2026-09-09). The earlier Exposure line described only S4GET's scope, so systems on older kernels, classic ABAP and ECC included, need the OVERPASS kernel patch as well.
Sources6
Revision history
- Published 2026-09-10T0410Z-intel
- Update 2026-10-10T0255Z-intel
An open-source SAP exploitation toolkit, SAPMAP, publicly released on 2026-09-15, carries proof-of-concept exploits for both flaws, including OVERPASS exploits that the maintainers first said they were withholding. Onapsis had not observed attackers using it when it wrote, and no exploitation is reported. The OVERPASS routes were re-cited to Onapsis and an unsupported discriminator in the triage line was removed.
Changed: summary tags cves sources evidence actions sourcing_note body
- Correction 2026-10-11T1307Z-audit
The Exposure line gave only S4GET's kernel scope, so a reader on an older kernel line would have concluded neither flaw applied; OVERPASS, the CVSS 10.0 flaw, affects kernel lines from 7.22 to 9.20. The headline no longer calls both flaws maximum severity (S4GET is 9.8), and the ACL sentence gains its citation.
Changed: headline body
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.