SAP September 2026 Patch Day Critical Vulnerabilities

In September 2026, SAP released twenty-two security patches, highlighting significant risks in core infrastructure components. Most notable are the 'OVERPASS' (CVE-2026-44756) and 'S4GET' (CVE-2026-58240) vulnerabilities, both discovered by Onapsis Research Labs. These vulnerabilities affect the SAP Kernel and NetWeaver Message Server respectively, representing severe risks to the integrity and availability of SAP environments.

Technically, OVERPASS is a memory corruption flaw in SAP Extended Passport (EPP) processing that allows unauthenticated attackers to execute arbitrary OS commands. S4GET involves a missing authentication check in the Message Server, enabling unauthorized component registration across the modern kernel family (9.16 to 9.20). Additionally, vulnerabilities in SAP Commerce Cloud and SAP Cloud Application Programming Model (CAP) provide paths for credential disclosure and improper authorization.

These vulnerabilities impact critical business operations globally, affecting sectors from manufacturing to energy. Given that OVERPASS is exploitable remotely without authentication and bypasses standard network controls, immediate patching of ABAP/Java kernels and SAP Web Dispatcher is required to prevent full system compromise.