CyberzSOC

Critical Vulnerabilities in SAP Kernel On 8 September 2026, as part of its September Security Patch Day, SAP released Security Notes addressing two critical vulnerabilities affecting a broad range of SAP products [1][3]. The most severe, CVE-2026-44756 (CVSS 10.0), is a memory corruption vulnerability in SAP Extended Passport (EPP) processing, nicknamed “OVERPASS” by the Onapsis Research Labs (ORL), which discovered and responsibly disclosed it [2][3]. The second, CVE-2026-58240 (CVSS 9.8), nicknamed “S4GET”, is a missing authentication check in the SAP NetWeaver Message Server [3][6]. According to the reporting researchers, successful exploitation of either can result in arbitrary operating system command execution under the account that owns the SAP installation, leading to full compromise of the affected system and the business data it holds [2][6]. CERT-EU strongly recommends applying SAP Security Notes 3747649 and 3759472 as soon as CVE-2026-44756 - “OVERPASS” (CVSS 10.0) CVE-2026-44756 is a memory corruption vulnerability in the SAP Kernel library that processes the Extended Passport (EPP), addressed by SAP Security Note 3747649 [1][4].