SAP users are urged to apply the latest security updates released by the company, which address several critical vulnerabilities. Among the most severe are two flaws discovered and reported by SAP security firm **Onapsis**, capable of profoundly impacting the confidentiality, integrity, and availability of SAP applications.  ## OVERPASS: CVE-2026-44756 (CVSS: 10.0) The most critical vulnerability, tracked as **CVE-2026-44756** and codenamed **OVERPASS**, is a memory corruption flaw residing in the **SAP kernel's** processing of **Extended Passport (EPP)** data. This maximum-severity vulnerability boasts a **CVSS score of 10.0**. Exploitable remotely and without authentication, OVERPASS allows malicious actors to execute arbitrary operating system commands on the SAP host with administrative privileges. This can lead to a total compromise of underlying SAP business data and processes. The flaw stems from a missing boundary validation during the deserialization of EPP data, resulting in a memory safety violation. An unauthenticated attacker can send crafted network requests containing a malformed EPP header, triggering unintended behavior and program termination. **Onapsis CTO JP Perez-Etchegoyen** explained, "OVERPASS is a flaw in the SAP kernel code that processes this structure. A specially-crafted request sent to an affected system can be abused to take control of the receiving process and, from there, run operating system commands on the host." Its widespread reach is particularly concerning: "Because EPP processing is shared kernel code used by more than one protocol, the flaw is reachable from the internet-facing web layer, from the SAP GUI layer every end user connects to, and from the RFC layer that links SAP systems to one another. It is reachable through several SAP components and several communication protocols, none of them requiring credentials, so no single network control can fully mitigate risk." Successful exploitation could enable an attacker to: * Read the **SAP secure store** to recover database credentials, password hashes, and all housed business data. * Read live session data of logged-in users. * Extract stored credentials to move laterally into other SAP systems. * Modify application data, system configuration, and SAP binaries. ## S4GET: CVE-2026-58240 (CVSS: 9.8) The second critical flaw, **CVE-2026-58240** (CVSS score: 9.8), is a missing authentication check in **SAP NetWeaver Message Server**, also discovered by **Onapsis**. Codename **S4GET**, this vulnerability allows unauthenticated attackers with network access to perform unauthorized actions. Security researcher **Pablo 'Partu' Agustin Artuso** clarified, "S4GET is a logic flaw, not a misconfiguration. It is present in SAP's 9.x kernel lines – the kernels that **SAP S/4HANA** and **SAP S/4HANA Cloud Private Edition** run on, and potentially other ABAP-based products as well." Its danger lies in its accessibility: "What makes it uniquely dangerous is its reachability: the flaw is triggered through the same public port that every SAP GUI client connects to, so it cannot be firewalled away without breaking the end-user logon. Exploitation requires no credentials, no certificate, and no pre-existing misconfiguration. A successful attack yields full remote code execution as `<sid>adm`, the OS-level user that runs SAP, on every application server in the cluster." ## Other Critical Flaws Addressed SAP also patched two other critical-rated security vulnerabilities: * **CVE-2026-76969** (CVSS score: 9.4): A credential disclosure vulnerability in multi-tenant applications using **SAP Cloud Application Programming Model (CAP)**. An unauthenticated attacker could obtain sensitive credentials via specially crafted requests, potentially replacing or deleting tenant data. * **CVE-2026-66768** (CVSS score: 9.0): An improper access control vulnerability in **SAP NetWeaver SAP GUI for Java**, allowing arbitrary command execution on the underlying host. ## Urgent Call to Action While none of these vulnerabilities have been exploited in the wild yet, their severity demands immediate attention. **Onapsis** strongly recommends that organizations: 1. Inventory every SAP system. 2. Prioritize patching internet-facing systems before internal instances. 3. Reduce exposure where possible. 4. Actively monitor for exploitation attempts. **Perez-Etchegoyen** emphasized the importance of visibility for **CVE-2026-44756**: "Ensure you have visibility into your SAP application layer so that attempts to exploit this vulnerability can be detected and investigated while the rollout is in progress." He also noted that traditional SAP authorization and Segregation of Duties (SoD) controls are ineffective against these specific threats: "One point is worth stating plainly: SAP authorizations and Segregation of Duties (SoD) controls will not help. The vulnerable code runs before any authentication step, so locking users, tightening roles, enforcing password policies or restricting transaction access has no effect on this attack path." IT security professionals and privacy-conscious users managing SAP environments must prioritize these updates to protect critical business data and operations.