GoKawiilSAP patches maximum-severity OVERPASS kernel flaw affecting 10,000+ systems
SAP's September 2026 security update fixes 20 vulnerabilities, headlined by CVE-2026-44756, a critical buffer overflow in the SAP Kernel's Extended Passport Protocol library dubbed OVERPASS by Onapsis researchers. The bug allows unprivileged attackers to remotely execute commands with admin rights via SAP's Internet Communication Manager, and Onapsis estimates over 10,000 internet-facing SAP systems are exposed. SAP also patched CVE-2026-58240, dubbed S4GET, a missing authentication issue in the NetWeaver Message Server that lets unauthenticated attackers compromise an entire SAP cluster.
GoKawiil's interpretation of the reporting above, not reported fact.
SAP systems run core financial, supply chain and HR operations for many of the world's largest enterprises, so remote code execution flaws reachable from the internet pose severe business risk. The combination of a maximum-severity bug with a large exposed attack surface and researcher-published technical details makes rapid exploitation likely once proof-of-concept code circulates. Organizations that delay patching or fail to identify exposed Web Dispatcher instances could face full system compromise.
- CVE-2026-44756 (OVERPASS) is a maximum-severity buffer overflow in SAP Kernel reachable via ICM.
- Onapsis says over 10,000 internet-facing SAP systems are potentially vulnerable, likely an undercount.
- A second critical flaw, S4GET (CVE-2026-58240), allows unauthenticated attackers to compromise entire SAP clusters.
Hacking: The Art of Exploitation, 2nd Edition (Jon Erickson) — OVERPASS is a textbook buffer overflow in SAP's Extended Passport Protocol library, and this No Starch Press classic is the go-to introduction to exactly how memory corruption bugs like it work. Jon Erickson walks through stack smashing, shellcode and defenses with hands-on examples, so defenders patching internet-facing SAP hosts can understand what an attacker is actually doing. A great desk reference for anyone on an appsec or SOC team.
See Hacking: The Art of Exploitation, 2nd Edition (Jon Erickson) on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-09-08
Published there as: “SAP warns of maximum severity 'OVERPASS' kernel vulnerability”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.