2026-011: Critical Vulnerabilities in SAP Kernel and NetWeaver Message Server
ID: 15d0fdc5-1e79-5bfd-ba0f-d51bf221320b
STIX ID: report--15d0fdc5-1e79-5bfd-ba0f-d51bf221320b
Feed Name: CERT-EU Security Advisories
On 8 September 2026 SAP released fixes for two critical unauthenticated remote vulnerabilities: CVE-2026-44756 ("OVERPASS"; CVSS 10.0), a memory-corruption deserialization flaw in Extended Passport processing enabling RCE as the SAP OS user, and CVE-2026-58240 ("S4GET"; CVSS 9.8), a missing authentication check in the NetWeaver Message Server that can allow an attacker to register as a trusted node and achieve RCE; CERT-EU and Onapsis recommend applying SAP Security Notes 3747649 and 3759472 immediately to mitigate full-system compromise risks.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.