SAP Fixes Two Critical Vulnerabilities in SAP Kernel and NetWeaver Message Server

SAP released fixes for CVE-2026-44756 with a CVSS score of 10.0 and CVE-2026-58240 with a CVSS score of 9.8. According to Onapsis, both vulnerabilities can be exploited remotely without authentication.

SAP critical vulnerabilities were fixed as part of the September Security Patch Day. On September 8, 2026, the company released security updates for two critical vulnerabilities in the SAP Kernel, SAP Web Dispatcher, and SAP NetWeaver Message Server components. Organizations should promptly verify the versions they use and follow the relevant SAP Security Notes.

SAP critical vulnerabilities: CVSS 10.0 and 9.8

The first vulnerability is CVE-2026-44756, which SAP addresses in Security Note 3747649. It involves memory corruption when processing the SAP Extended Passport (EPP). The vulnerability has a CVSS score of 10.0 and affects multiple versions of SAP Kernel and SAP Web Dispatcher.

The second vulnerability, CVE-2026-58240, is fixed through Security Note 3759472. SAP classifies it as a missing authentication check in SAP NetWeaver Message Server and assigns it a CVSS score of 9.8. Kernel branches 9.16, 9.18, 9.19, and 9.20 are affected.

Onapsis, the security firm that reported the vulnerabilities, calls CVE-2026-44756 OVERPASS and CVE-2026-58240 S4GET. According to its recommendations, both vulnerabilities can be exploited remotely without prior authentication.

Fixes are available in SAP Security Notes

Vendor fixes are available through Security Notes 3747649 and 3759472. In its public overview, SAP confirms the vulnerability types, their critical severity, the affected product branches, and the release of the fixes.

Administrators of SAP environments should identify the deployed versions of SAP Kernel, SAP Web Dispatcher, and SAP NetWeaver Message Server, compare them with the scope specified in the security notes, and deploy the relevant updates. CERT-EU also recommends applying SAP fixes without delay.

For CVE-2026-44756, the broader range of affected SAP Kernel and Web Dispatcher versions is important. For CVE-2026-58240, attention should also be paid to the network availability of the Message Server, including its availability within internal environments.

No confirmed active exploitation

When publishing its recommendations, Onapsis stated that it had not observed active exploitation of either vulnerability in the wild. However, this is not evidence that nobody attempted to exploit them or that exploitation did not occur outside the company’s observation.

Onapsis also describes a scenario involving reliable remote execution of arbitrary operating system commands. SAP does not confirm this specific impact scenario in its public overview; it lists the vulnerability types, severity, and availability of fixes.

Successful exploitation of a critical vulnerability in the affected SAP components could impact the confidentiality, integrity, and availability of enterprise systems and data. Deploying fixes and monitoring further information from SAP, CERT/CSIRT organizations, and security firms therefore remain priorities.

What to watch next

  • any confirmation of active exploitation,
  • updates to Security Notes 3747649 and 3759472, including the fixed patch levels,
  • indicators of compromise or additional mitigations for environments that cannot deploy the fix immediately.

Sources

  • SAP Security Patch Day – September 2026 – SAP confirms the release of Security Notes 3747649 and 3759472 on September 8, 2026, the vulnerability names, CVSS scores, and affected versions.
  • Onapsis – Mitigating OVERPASS (CVE-2026-44756) – The vulnerability reporter describes OVERPASS as a remotely exploitable pre-authentication vulnerability and states that it had not observed active exploitation at the time of disclosure.
  • Onapsis – S4GET (CVE-2026-58240) – The vulnerability reporter describes S4GET, the available fix, and the absence of active exploitation observed by it as of the publication date.
  • CERT-EU Security Advisory 2026-011 – The independent security advisory confirms the criticality of both CVEs, the affected product branches, and the recommendation to apply SAP fixes without delay.

Verified and updated: 09/10/2026 15:26

Tags
Sharing

Súvisiace