What Happened
This SAP NetWeaver vulnerability is worth putting at the top of your patch list this week. CERT-EU published an advisory about two critical flaws that SAP addressed on 8 September 2026 as part of its September Security Patch Day.
The most severe, CVE-2026-44756, is a memory corruption vulnerability in SAP Extended Passport (EPP) processing. It has a CVSS score of 10.0 and is nicknamed OVERPASS by Onapsis Research Labs, which discovered and responsibly disclosed it. The second, CVE-2026-58240, is a missing authentication check in the SAP NetWeaver Message Server. It has a CVSS score of 9.8 and is nicknamed S4GET.
Both are remotely exploitable without authentication. According to the reporting researchers, successful exploitation of either can result in arbitrary operating system command execution under the account that owns the SAP installation, which means full compromise of the affected system and the business data it holds. CERT-EU strongly recommends applying SAP Security Notes 3747649 and 3759472 as soon as possible.
Timeline
Here is the published timeline so far.
- 8 September 2026: SAP released Security Notes 3747649 and 3759472 as part of its September Security Patch Day.
Who Is Affected
The advisory says these vulnerabilities affect a broad range of SAP products. The affected components named in the advisory are SAP Kernel, SAP NetWeaver Message Server, and SAP Extended Passport (EPP) processing.
If you support SAP systems, assume any SAP Kernel or NetWeaver Message Server installation is potentially in scope until you check SAP Security Notes 3747649 and 3759472. Those notes identify the affected releases and the patches for each component.
In general, SAP systems hold the kind of data that makes a full compromise serious: financial records, employee data, and integration points with other business systems. The account that owns the SAP installation often has broad access to the operating system, which is why a command execution flaw is treated as critical.
Why It Matters for MSPs
From an MSP perspective, the important thing is that these are no-credential bugs. A vulnerability that does not require authentication lowers the bar for attackers, because they do not need a foothold or a stolen password to start probing.
Most MSPs will not run a dedicated SAP practice, but many will have at least one client with SAP in the environment. The patch decision is not just technical. It affects maintenance windows, client communication, and change management. Starting the conversation early is better than explaining a compromise later.
Technical Details: SAP NetWeaver Vulnerability
CVE-2026-44756 is a memory corruption vulnerability in SAP Extended Passport (EPP) processing, with a CVSS score of 10.0. It is nicknamed OVERPASS and was discovered and responsibly disclosed by Onapsis Research Labs.
CVE-2026-58240 is a missing authentication check in the SAP NetWeaver Message Server, with a CVSS score of 9.8. It is nicknamed S4GET.
Attack vector: both are remotely exploitable without authentication. Successful exploitation can result in arbitrary operating system command execution under the account that owns the SAP installation, leading to full compromise of the affected system and the business data it holds. For version-specific details, refer to SAP Security Notes 3747649 and 3759472.
What to Do This Week
Start with the notes, then work through the normal patching checklist for SAP.
- Apply SAP Security Notes 3747649 and 3759472 as soon as possible. Follow SAP's instructions for your exact release and component.
- Check the notes for affected releases, prerequisites, and any manual steps. SAP patches often require multiple steps and a restart.
- Confirm which of your clients run SAP Kernel, NetWeaver Message Server, or Extended Passport processing. Build the list before you schedule changes.
- If you cannot patch immediately, apply any interim mitigations in the notes and restrict network access to the affected services. As a standing practice, SAP administration ports and message server ports should not be exposed to the internet.
- Review your monitoring and alerting on SAP systems for unusual process execution, new accounts, or unexpected changes. Standard log review becomes more important when a public advisory is out.
What to Tell Clients
Two critical SAP vulnerabilities were disclosed in September. An attacker can exploit them remotely without a password, and successful exploitation can give full control of the SAP server and the data on it.
We are checking SAP Security Notes 3747649 and 3759472 against your environment to confirm whether you are affected. If you are, we will schedule the patch in a maintenance window.
Until then, we will make sure the affected services are not exposed and that monitoring is in place. You do not need to do anything unless we ask for a maintenance window.
Frequently Asked Questions
What Is CVE-2026-44756?
CVE-2026-44756 is a critical memory corruption vulnerability in SAP Extended Passport (EPP) processing, with a CVSS score of 10.0. Onapsis Research Labs discovered it and gave it the nickname OVERPASS. Exploitation can lead to arbitrary operating system command execution on the SAP server.
What Is CVE-2026-58240?
CVE-2026-58240 is a missing authentication check in the SAP NetWeaver Message Server, with a CVSS score of 9.8. The researchers nicknamed it S4GET. It is remotely exploitable without authentication and can also lead to command execution.
Are These SAP Vulnerabilities Being Exploited in the Wild?
The advisory does not say either vulnerability is being exploited. It does say both are remotely exploitable without authentication and can lead to full compromise, so patching should be treated as urgent.
Which SAP Products Are Affected?
The advisory says a broad range of SAP products are affected, including SAP Kernel, SAP NetWeaver Message Server, and SAP Extended Passport processing. SAP Security Notes 3747649 and 3759472 identify the exact affected releases.
What Should I Do If I Cannot Apply the SAP Security Notes Right Away?
Apply the Security Notes as soon as possible, and in the meantime use any interim mitigations in the notes. Restrict network access to the affected services and check that SAP systems are not exposed to the internet. Review monitoring for signs of command execution or unauthorized changes.
Do These Vulnerabilities Require Authentication?
No. The advisory states both are remotely exploitable without authentication. That makes them more urgent, because an attacker does not need valid SAP credentials to target the service.