VulnerabilitiesSep 9, 2026

2026-011: Critical Vulnerabilities in SAP Kernel and NetWeaver Message Server

SAP releases patches for two critical vulnerabilities, OVERPASS and S4GET, allowing remote code execution.

SAP has released security notes addressing two critical vulnerabilities, CVE-2026-44756 (OVERPASS) and CVE-2026-58240 (S4GET), discovered by Onapsis Research Labs. Both vulnerabilities are remotely exploitable without authentication and can lead to arbitrary operating system command execution, enabling full compromise of affected SAP systems and their business data. CERT-EU urges immediate application of the relevant SAP Security Notes.

AI summary of the linked source. Not reviewed by an editor. How this works

Read at source

Vendor Watch

Run SAP?

Get an email when a new story names SAP, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch works Privacy

The lesson from this incident

Full lesson

Two critical vulnerabilities in SAP Kernel and NetWeaver Message Server allow remote attackers to execute arbitrary operating system commands without any authentication, enabling full system compromise. Because SAP platforms sit at the heart of enterprise business operations — handling financials, HR, and supply chain data — a successful exploit can expose an organisation's most sensitive assets entirely. The fact that no credentials are required dramatically lowers the bar for attackers, making unpatched internet-facing SAP instances an extremely high-value and accessible target. Delayed patching of enterprise middleware like SAP is a persistent organisational blind spot, often because change-management processes treat ERP updates with excessive caution relative to the risk of leaving critical flaws unaddressed.

What helps against this

How we list vendors

Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
For exampleHolm Security Platform Axonius Exposures Qualys VMDR all options
Automated patch management
Known holes get closed in days, not months.
For exampleIvanti Neurons for Patch Management Action1 Patch Management NinjaOne Patch Management all options
Network segmentation and microsegmentation
One compromised machine can no longer reach everything else.
For exampleAkamai Guardicore Segmentation Illumio Segmentation ThreatLocker Zero Trust Endpoint Firewall all options

Indicators of Compromise

Extracted by AI from the linked source. Not reviewed by an editor. How this works

cve — CVE-2026-44756
cve — CVE-2026-58240

Entities

SAP Extended Passport (product)SAP NetWeaver Message Server (product)SAP (vendor)Onapsis Research Labs (threat_actor)OVERPASS (campaign)S4GET (campaign)