# SAP's September Patch Drop: OVERPASS and S4GET Expose Critical Flaws

SAP has released its September 2026 security updates, addressing 20 vulnerabilities across its product portfolio—including two severe flaws that security researchers say could lead to complete system compromise. The most critical of these, a maximum-severity memory corruption vulnerability in the SAP Kernel dubbed "OVERPASS," affects more than 10,000 Internet-facing systems, while a second critical authentication bypass in the NetWeaver Message Server allows unauthenticated remote code execution across entire SAP clusters.

## OVERPASS: A Kernel-Level Nightmare

Tracked as CVE-2026-44756, the OVERPASS vulnerability stems from a classic buffer overflow weakness in the Extended Passport Protocol (EPP) processing library. Discovered and reported by Onapsis security researchers, this memory corruption flaw allows unprivileged threat actors to execute arbitrary commands on vulnerable SAP hosts with administrative privileges, leading to full compromise of underlying SAP processes and business data.

What makes OVERPASS particularly dangerous is its attack vector. The vulnerability can be exploited through SAP Internet Communication Manager (ICM), the networking component of the SAP Application Server that connects SAP NetWeaver Application Server systems to the Internet via HTTP, HTTPS, and SMTP protocols. This means the attack surface extends well beyond internal networks—any Internet-facing SAP deployment is potentially at risk.

According to Onapsis' estimates, the exposure is staggering. "A targeted search using high-fidelity fingerprints identifies more than 10,000 unique Internet-facing IP addresses presenting an SAP web interface reachable from the public Internet, and that figure is conservative," said Onapsis CTO JP Perez-Etchegoyen. "It counts only HTTP-reachable systems and materially undercounts the SAP Web Dispatcher, which proxies its backend and returns no distinguishing SAP banner on its root path, making it structurally hard for Internet-wide scanners to attribute."

## S4GET: Critical Authentication Bypass in NetWeaver Message Server

SAP also addressed CVE-2026-58240, a critical missing authentication vulnerability in the SAP NetWeaver Message Server. Named S4GET by Onapsis Research Labs, this flaw allows unauthenticated attackers to access the entire SAP system cluster and execute malicious payloads and arbitrary commands remotely across the network.

The severity of S4GET cannot be overstated. Onapsis security researcher Pablo Artuso explained the unique challenge this vulnerability presents: "The flaw is triggered through the same public port that every SAP GUI client connects to, so it cannot be firewalled away without breaking the end-user logon."

Artuso further detailed the exploitation requirements: "Exploitation requires no credentials, no certificate, and no pre-existing misconfiguration. A successful attack yields full remote code execution as `adm`, the OS-level user that runs SAP, on every application server in the cluster."

This means a single unauthenticated request could give an attacker complete control over an organization's entire SAP infrastructure—including access to sensitive business data, financial records, and potentially the underlying operating system.

## A Growing Pattern of SAP Vulnerabilities

The September 2026 patches follow a concerning trend in SAP security. Last month, the company fixed another maximum-severity vulnerability (CVE-2026-58231) in the Commerce Cloud e-commerce platform, which threat intelligence company Defused flagged as actively exploited in attacks just days after the patch was released.

The pattern of active exploitation is particularly troubling. Since November 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added 14 SAP security flaws to its list of actively exploited vulnerabilities, including three that were abused by ransomware gangs. This demonstrates that threat actors are not only aware of SAP vulnerabilities but are actively weaponizing them in real-world attacks.

## Why SAP Security Matters

SAP is a German multinational software company that reported total revenues exceeding €36 billion in fiscal year 2025 and provides services to 99 of the 100 largest companies worldwide. This means SAP systems often sit at the heart of enterprise operations, managing everything from supply chain logistics to human resources and financial reporting.

A successful attack on an SAP system can have cascading consequences. Beyond the immediate data breach, compromised SAP systems can be used as a launching pad for lateral movement within corporate networks, enabling attackers to reach other critical infrastructure. The business impact of such breaches can include regulatory fines, reputational damage, and significant operational disruption.

## Recommendations for SAP Administrators

Organizations running SAP systems should take immediate action to mitigate these vulnerabilities:

1. **Apply the September 2026 security patches immediately** to all affected SAP products, prioritizing the OVERPASS and S4GET fixes.

2. **Audit Internet-facing SAP systems** to identify any deployments that may be exposed to exploitation. Pay special attention to SAP Web Dispatcher instances that may not be easily detectable through standard scanning.

3. **Monitor for indicators of compromise** related to CVE-2026-44756 and CVE-2026-58240, particularly unusual network traffic on SAP ICM ports and unexpected processes running as `adm`.

4. **Review access controls** and ensure that the principle of least privilege is enforced across all SAP systems and components.

5. **Stay informed about emerging threats** by monitoring CISA's Known Exploited Vulnerabilities catalog and SAP's security notes.

## The Bottom Line

The OVERPASS and S4GET vulnerabilities represent a significant threat to organizations running SAP systems. With more than 10,000 Internet-facing systems potentially exposed to OVERPASS and S4GET requiring no authentication whatsoever, the window for exploitation is wide open for organizations that delay patching.

The fact that these vulnerabilities were responsibly disclosed by security researchers and quickly patched by SAP is positive, but the real test comes in the coming weeks as threat actors race to develop exploits. History has shown that SAP vulnerabilities are increasingly targeted by ransomware gangs and sophisticated cybercriminal operations.

Organizations must treat these patches as urgent priorities. In the world of enterprise cybersecurity, the cost of prevention is always lower than the cost of remediation—and with vulnerabilities of this severity, the stakes have never been higher.