CVE Tools
Track your stack

SAP warns of maximum severity 'OVERPASS' kernel vulnerability

BleepingComputerBy Sergiu Gatlan

AdvisorySAP S/4HANAOnapsisSAP NetWeaver

Our summary

SAP has released September 2026 security updates addressing 20 vulnerabilities, including a maximum-severity buffer overflow in the SAP Kernel dubbed OVERPASS. Identified as CVE-2026-44756 by Onapsis researchers, this flaw allows unprivileged attackers to gain administrative command execution on vulnerable hosts via the Internet Communication Manager. Additionally, SAP resolved CVE-2026-58240, a missing authentication issue in the NetWeaver Message Server known as S4GET, which permits remote code execution across entire system clusters without credentials. Onapsis estimates that over 10,000 internet-facing SAP systems are potentially exposed to these attacks.

Read at BleepingComputer

BleepingComputer publishes this story on its own site; we link to it rather than reprint it.

  1. The Hacker News⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, PaperCut Attacks, AI Espionage, and RootkitsCVE-2026-44756, CVE-2026-58240
  2. The Hacker NewsSAP Patches CVSS 10.0 Kernel Flaw Enabling Unauthenticated Remote Code ExecutionCVE-2026-44756, CVE-2026-58240
  3. SecurityWeekSAP Patches Critical Extended Passport Processing VulnerabilityCVE-2026-44756, CVE-2026-58240
  4. SecurityWeekIn Other News: Ransomware Developer Sentenced, Plugin4Shell AI Attack, Critical SAP FlawCVE-2026-44756
  5. The Hacker News⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and MoreCVE-2026-58231
  6. SecurityWeekCritical SAP Commerce Cloud Vulnerability Exploited 3 Days After DisclosureCVE-2026-58231
  7. The Hacker NewsSAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts Days After PatchCVE-2026-58231
  8. BleepingComputerMax severity SAP Commerce Cloud flaw now targeted in attacksCVE-2026-58231
  9. The Hacker NewsSAP Commerce Cloud Flaw Could Let Unauthenticated Attackers Execute Arbitrary CodeCVE-2026-58231
  10. SecurityWeekSAP Patches Critical Code Injection, Memory Corruption VulnerabilitiesCVE-2026-58231

Worried this affects your company?

Discuss a security assessment of your internet-facing systems. Scope agreed before testing.

Check my exposure

We use analytics cookies to see which pages and articles actually help people. Decline and none of them run — the site works the same. What we store