SAP Patches Critical Unauthenticated RCE Bugs
ID: b02721d0-65ea-5f7a-8811-3764d819f43e
STIX ID: report--b02721d0-65ea-5f7a-8811-3764d819f43e
Feed Name: Kudelski Security
Threat Score
SAP released emergency September 2026 patches for two critical, unauthenticated RCE vulnerabilities—OVERPASS (CVE-2026-44756, CVSS 10.0) and S4GET (CVE-2026-58240, CVSS 9.8)—that can lead to full compromise of SAP systems via standard SAP network ports; customers are urged to apply SAP Security Notes immediately and prioritize internet-facing and NetWeaver Message Server instances because firewalls cannot fully mitigate the risk.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.