SAP Fixes Kernel Flaw Enabling Unauthenticated Remote Code Execution

"OVERPASS is a flaw in the SAP kernel code that processes this structure. A specially-crafted request sent to an affected system can be abused to take control of the receiving process and, from there, run operating system commands on the host," Onapsis CTO JP Perez-Etchegoyen said.

The OVERPASS kernel flaw: CVE-2026-44756 (CVSS 10.0)

SAP has patched a maximum-severity kernel vulnerability tracked as CVE-2026-44756 and codenamed OVERPASS. Onapsis, the SAP security company that discovered and reported the issue, describes it as a memory-corruption bug in the SAP kernel's processing of Extended Passport (EPP) data. The vulnerability stems from a missing boundary validation during deserialization: externally supplied length fields can trigger a memory safety violation when the kernel processes a malformed EPP header.

The practical effect is severe. OVERPASS is exploitable remotely and without authentication; an attacker can send crafted network requests containing a malformed EPP header to cause unintended behavior, abnormal program termination, or take control of the receiving process. From there, attackers can run arbitrary operating system commands on the SAP host with SAP administrative privileges, risking total compromise of business data and processes hosted on the system.

Reachability: why a single firewall won't fix this

Onapsis warned that EPP processing is shared kernel code used by multiple protocols and components. The flaw is reachable from the internet-facing web layer, from the SAP GUI layer every end user connects to, and from the RFC layer that links SAP systems to one another. "It is reachable through several SAP components and several communication protocols, none of them requiring credentials, so no single network control can fully mitigate risk," Perez-Etchegoyen said.

Because the vulnerable code runs before authentication, SAP authorizations and Segregation of Duties (SoD) controls cannot stop this attack path. Perez-Etchegoyen noted that locking users, tightening roles, enforcing password policies or restricting transaction access has no effect on exploitation that occurs prior to authentication.

S4GET and the other critical fixes: CVE-2026-58240, CVE-2026-76969, CVE-2026-66768

SAP's update also addresses CVE-2026-58240 (CVSS 9.8), a missing authentication check in SAP NetWeaver Message Server Onapsis named S4GET. Researcher Pablo 'Partu' Agustin Artuso characterized S4GET as "a logic flaw, not a misconfiguration." According to Onapsis, it exists in SAP's 9.x kernel lines — the kernels that SAP S/4HANA and SAP S/4HANA Cloud Private Edition run on, and potentially other ABAP-based products. S4GET is reachable through the same public port used by SAP GUI clients; exploitation requires no credentials, no certificate, and no pre-existing misconfiguration, and yields full remote code execution as the OS-level user that runs SAP (adm) on every application server in a cluster.

Two additional critical-rated fixes are included in the patch set: CVE-2026-76969 (CVSS 9.4), a credential disclosure vulnerability in multi-tenant applications using the SAP Cloud Application Programming Model (CAP) that can let an unauthenticated attacker obtain sensitive credentials and then replace or delete tenant data; and CVE-2026-66768 (CVSS 9.0), an improper access control bug in SAP NetWeaver SAP GUI for Java that allows execution of arbitrary commands on the underlying host.

SAP and Onapsis report that none of these vulnerabilities have been observed in the wild to date, but their criticality prompted immediate remediation actions.

Onapsis' recommended mitigation steps for SAP operators

• Inventory every SAP system to identify affected installations and prioritize updates.
• Patch internet-facing systems before internal instances to reduce exposure to unauthenticated remote attacks.
• Reduce exposure where possible by limiting unnecessary external reachability of SAP components and ports.
• Monitor for exploitation attempts and ensure visibility into the SAP application layer so attempts can be detected and investigated during rollout.

Onapsis emphasized visibility into the application layer as essential while organizations roll out fixes, and reiterated that conventional SAP authorization controls do not mitigate these flaws because the vulnerable code executes prior to authentication.

What this means for technologists, IT leaders, and defenders

• Technologists and security teams: Prioritize immediate identification of internet-facing SAP endpoints and apply the kernel and component patches. Monitor network and application logs for malformed EPP headers and abnormal process behavior as part of active detection while patching proceeds.
• IT and procurement leaders: Treat this patch cycle as mission-critical for affected SAP products (including S/4HANA and SAP Cloud Application Programming Model deployments) and sequence updates so externally reachable systems are fixed first.
• Defenders and incident response teams: Prepare for worst-case post-exploitation scenarios described by Onapsis — including theft of credentials from SAP secure store, reading live session data, lateral movement to other SAP systems, and modification of application data, system configuration, and binaries — and verify that monitoring is tuned to detect such activity.

The discovery and public disclosure of OVERPASS, S4GET and the related critical flaws close a narrow window in which unauthenticated, remote exploitation could yield full control of SAP hosts. The core questions left by the record are operational: how quickly vendors and operators apply the kernel updates, how comprehensively organizations identify exposed SAP endpoints, and whether monitoring efforts catch attempted exploitation before attackers can move laterally. For now, the immediate task is plain — inventory, patch internet-facing systems first, reduce exposure, and watch closely for signs of intrusion.

Original story