SAP OVERPASS CVE-2026-44756: CVSS 10.0 Kernel RCE Explained

SAP’s September 2026 Security Patch Day includes two vulnerabilities that stand out from the rest: CVE-2026-44756, a maximum-severity CVSS 10.0 memory corruption flaw dubbed “OVERPASS,” and CVE-2026-58240 (codenamed “S4GET”), a critical authentication bypass in the NetWeaver Message Server. Both were discovered and disclosed by SAP security firm Onapsis, and both give an attacker unauthenticated, pre-logon remote code execution that bypasses the network and application-layer defenses most SAP shops rely on.

Researchers tracking exposure estimate that tens of thousands of internet-facing SAP systems are potentially reachable. Here’s how these vulnerabilities work, why Segregation of Duties (SoD) controls don’t help here, and what to do about it.

CVE-2026-44756 (OVERPASS): a CVSS 10.0 kernel flaw

How the SAP Extended Passport works

OVERPASS lives in the SAP Extended Passport (EPP), a data structure that distributed SAP environments use to evaluate call sequences, correlate log traces, and perform end-to-end tracing across system landscapes. Every SAP GUI interaction, RFC (Remote Function Call), or HTTP request through the Internet Communication Framework (ICF) generates an EPP header, which gets passed between application servers to maintain transactional context.

How the stack overflow works

Tracked as CVE-2026-44756, OVERPASS is a memory corruption flaw in the SAP kernel’s deserialization logic. The bug sits in how the kernel parses the sap-passport header, and that parsing happens entirely before any logon or authentication step.

During that pre-authentication parsing, the kernel doesn’t validate boundaries properly. An unauthenticated attacker can send a crafted packet with a malformed EPP header where a forged “wire length” field gets accepted at face value and used as the write boundary for a fixed-size stack buffer. The resulting stack-based buffer overflow lets an attacker overwrite the instruction pointer, take over the receiving process, and run arbitrary OS commands with SAP administrative privileges.

Why it’s hard to contain

What makes OVERPASS dangerous is how many paths reach it. Because EPP processing runs through shared kernel code, the flaw isn’t confined to one obscure protocol. “The flaw is reachable from the internet-facing web layer, from the SAP GUI layer every end user connects to, and from the RFC layer that links SAP systems to one another,” Onapsis CTO JP Perez-Etchegoyen said.

That means no single firewall rule can block the risk without also cutting off legitimate business traffic. A successful exploit gives the attacker full control of the host: they can read the SAP secure store to recover database credentials, pull live session data from logged-in users, and modify application binaries to plant persistent backdoors.

CVE-2026-58240 (S4GET): SAP NetWeaver Message Server

How the Message Server gets compromised

SAP patched CVE-2026-58240 alongside OVERPASS: a critical CVSS 9.8 missing authentication check in the SAP NetWeaver Message Server, codenamed S4GET. In NetWeaver architecture, the Message Server is the central cluster broker, handling internal message exchange and load balancing across application servers within the Central Services (ASCS) instance.

From logic flaw to <sid>adm compromise

Unlike OVERPASS, S4GET is a logic flaw rather than a memory corruption bug, and it lives in SAP’s 9.x kernel lines, the kernels behind modern S/4HANA and S/4HANA Cloud Private Edition deployments. Security researchers found that the Message Server “does not sufficiently validate the authenticity of internal application server components” during certain inter-node requests.

Because the flaw triggers through the same public port every SAP GUI client uses, you can’t firewall it off without breaking logon for everyone. Exploitation needs no credentials, no certificates, no pre-existing misconfiguration. A successful attack gets an attacker full remote code execution as <sid>adm, the OS-level superuser that runs the SAP instance, which effectively compromises every application server in the cluster. Security professionals on LinkedIn and X have flagged S4GET as one of the more severe pre-authentication RCE vectors seen in S/4HANA environments.

Two more vulnerabilities worth patching

OVERPASS and S4GET aren’t the only fixes in this Patch Day. Two more high-severity vulnerabilities need attention too:

• CVE-2026-76969 (CVSS 9.4), SAP CAP model credential disclosure: Affects multi-tenant applications built on the SAP Cloud Application Programming Model (CAP). An unauthenticated attacker can send crafted requests to extract credentials, then use them to replace or delete tenant data across the cloud environment.
• CVE-2026-66768 (CVSS 9.0), SAP GUI for Java improper access control: An access control bypass in the SAP GUI for Java client that lets an attacker execute arbitrary commands on the host machine of whoever is running the client.

Why SoD controls won’t save you

Most enterprise SAP security programs lean heavily on GRC (Governance, Risk, and Compliance) tooling and strict Segregation of Duties controls to prevent insider threats and unauthorized data access. Onapsis researchers are blunt about the limits here: SAP authorizations and SoD controls provide zero protection against OVERPASS and S4GET.

Both vulnerabilities exploit shared kernel code that runs before the application layer even checks authentication. Locking users, tightening PFCG roles, enforcing password policies, or restricting transaction access through SU24 has no effect on the attack path. The payload fires at the OS and kernel level, well before the SAP application evaluates anyone’s identity.

Remediation and incident response

Given the pre-authentication nature and severity of these flaws, a standard wait-and-test patching cycle isn’t a good idea here. Move fast:

1. Inventory the landscape. Use SAP Solution Manager or third-party asset management tools to inventory every SAP system, paying particular attention to legacy instances on older 7.x kernels and modern S/4HANA deployments on 9.x kernels.
2. Prioritize internet-facing systems. Patch internet-facing systems, web dispatchers, and DMZ-placed SAP routers before internal instances. Researchers put the number of potentially exposed internet-facing SAP systems above 10,000.
3. Apply the SAP Security Notes. Pull the relevant notes from the September 2026 Patch Day through the SAP Support Portal. Test kernel updates in a QAS environment first to catch ABAP dumps or instability, but move the PRD transport quickly once that’s done.
4. Add application-layer monitoring. Network firewalls can’t block EPP or Message Server traffic without breaking business operations, so visibility has to come from the application layer itself. Configure SAP Security Audit Logs (SAL) and deploy threat detection tools that watch for abnormal program terminations or malformed sap-passport headers, both of which are indicators of exploitation attempts.

Conclusion

CVE-2026-44756 (OVERPASS) and CVE-2026-58240 (S4GET) both bypass years of security assumptions built around network segmentation and role-based access, because they hit shared, pre-authentication kernel code sitting underneath all of it. The fix is prioritized kernel patching, not more SoD tooling. Given the exposure numbers already circulating, treat this as a race against the first working exploit, not a routine patch cycle.