SAP fixes CVSS 10.0 kernel flaw enabling pre-auth code execution
SAP issues fixes for four critical vulnerabilities
SAP has released security updates for multiple high-severity vulnerabilities, led by CVE-2026-44756, a CVSS 10.0 memory-corruption flaw in SAP Extended Passport (EPP) Processing. The issue, dubbed OVERPASS by SAP security company Onapsis, affects SAP kernel code and can allow an unauthenticated remote attacker to execute arbitrary operating-system commands on an SAP host with SAP administrative privileges.
Onapsis said successful exploitation could result in a complete compromise of SAP business data and processes. The company discovered and reported the vulnerability. SAP also addressed CVE-2026-58240, a CVSS 9.8 missing-authentication issue in SAP NetWeaver Message Server, known as S4GET, as well as two further critical vulnerabilities.
How the OVERPASS flaw is reached
CVE-2026-44756 is caused by missing boundary validation while deserialising EPP data. Externally supplied length fields can trigger a memory-safety violation. An attacker can send a specially crafted network request with a malformed EPP header to cause unintended behaviour and abnormal program termination.
JP Perez-Etchegoyen, CTO at Onapsis, said a crafted request to an affected system can take control of the receiving process and then run operating-system commands on the host. EPP processing is shared kernel code used by more than one protocol, making the flaw reachable through internet-facing web components, the SAP GUI layer and the RFC layer used to link SAP systems.
Those paths do not require credentials. Perez-Etchegoyen said no single network control can fully mitigate the risk because the vulnerable processing is accessible through several SAP components and communication protocols. SAP authorisations, segregation-of-duties controls, tightened roles and password policies do not stop this path because the affected code executes before authentication.
Other critical updates and response priorities
With successful exploitation of OVERPASS, an attacker may read the SAP secure store to recover database credentials and password hashes, access live session data, extract stored credentials for lateral movement, and alter application data, configuration or SAP binaries.
S4GET affects SAP 9.x kernel lines used by SAP S/4HANA and SAP S/4HANA Cloud Private Edition, and potentially other ABAP-based products. Onapsis said its public-port reachability means it cannot be firewalled off without disrupting SAP GUI user logons. A successful attack can provide remote code execution as the operating-system user that runs SAP on every application server in a cluster.
The additional fixes cover CVE-2026-76969, scored 9.4, in multi-tenant applications using SAP Cloud Application Programming Model, where crafted requests may disclose sensitive credentials and enable replacement or deletion of tenant data. CVE-2026-66768, scored 9.0, is an improper access-control issue in SAP NetWeaver SAP GUI for Java that can allow arbitrary command execution on the host.
No exploitation has been reported, but Onapsis recommends inventorying all SAP systems, patching internet-facing instances before internal systems, reducing exposure where possible and monitoring for attempted exploitation during rollout. For businesses, the immediate implication is to treat these updates as an application-layer response priority rather than relying on user permissions or perimeter controls.