2026-011: Critical Vulnerabilities in SAP Kernel and NetWeaver Message Server

Una richiesta specificamente formattata a SAP p uò bypassare la verifica dell’accesso, raggiungere il kernel e concedere a un malintenzionato il controllo del server . Di conseguenza, l’attaccante ottiene accesso non solo all’applicazione, ma anche ai dati utente, alle sessioni attive, alle informazioni finanziarie e ad altri dati aziendali dell’azienda. La vulnerabilità critica nello specifico è il  CVE-2026-44756 , la quale ha ricevuto il punteggio massimo di 10 secondo CVSS ed è stata denominata OVERPASS. Il problema risiede nel codice del kernel SAP , che gestisce il protocollo Extended Passport Protocol (EPP). SAP utilizza EPP per tracciare le richieste e monitorare le chiamate tra sistemi collegati. Il principale pericolo è legato al momento in cui viene elaborato l’EPP . Il kernel analizza la struttura durante l’apertura di una nuova sessione, prima ancora dell’autenticazione dell’utente. Pertanto, il blocco degli account, le password complesse, i ruoli e i limiti di autorizzazione non impediscono l’attacco. Una richiesta specificamente formattata consente di prendere il controllo del processo ed eseguire comandi arbitrari del sistema operativo con privilegi amministrativi SAP. Il problema coinvolge diversi percorsi di accesso. L’attaccante può raggiungere il codice vulnerabile attraverso lo strato web di SAP Internet Communication Manager e SAP Web Dispatcher, le connessioni SAP GUI o Remote Function Call. La chiusura di un protocollo riduce la superficie di attacco, ma non elimina la vulnerabilità stessa. Dopo un attacco riuscito, il malintenzionato è in grado di leggere SAP Secure Store, estrarre le credenziali di accesso ai database e gli hash delle password, intercettare i dati delle sessioni utente attive e ottenere le credenziali salvate per spostarsi tra i sistemi SAP collegati . L’accesso consente anche di modificare la configurazione, le applicazioni e i file binari SAP stessi. Tra gli scenari possibili, gli esperti citano il furto di informazioni finanziarie e del personale, la modifica dei dati bancari dei fornitori, la creazione di utenti privilegiati, l’installazione di backdoor e l’avvio di ransomware. OVERPASS è presente nel codice generale del kernel, quindi il numero di prodotti potenzialmente interessati è ampio. Tra questi rientrano SAP S/4HANA, SAP ERP e Business Suite, NetWeaver Application Server ABAP, Web Dispatcher, BW/4HANA, Enterprise Portal, PI/PO, Solution Manager e altre soluzioni basate sullo stesso kernel. Gli esperti di Onapsis hanno identificato più di 10.000 indirizzi IP univoci con interfacce web SAP accessibili da Internet e considerano tale stima conservativa. Al momento della pubblicazione, il team di Onapsis non ha riscontrato segni di sfruttamento di OVERPASS in attacchi reali. Tuttavia, gli incidenti passati hanno dimostrato che i malintenzionati sono in grado di analizzare le patch di sicurezza rilasciate da SAP e passare allo sfruttamento di errori critici in pochi giorni. Pertanto, gli amministratori sono invitati a verificare innanzitutto le versioni del kernel sui sistemi accessibili da Internet, per poi aggiornare quelli interni, di test e dimenticati. SAP ha risolto la vulnerabilità nell’ambito degli aggiornamenti di sicurezza di settembre 2026 , rilasciando la Security Note 3747649. Un set di patch del kernel copre tutti i percorsi di sfruttamento noti di CVE-2026-44756 . Secondo Onapsis , l’unico modo per eliminare completamente il rischio è aggiornare il kernel. I limiti di rete possono temporaneamente ridurre la superficie di attacco, ma non proteggono tutte le interfacce contemporaneamente, poiché l’EPP vulnerabile viene elaborato attraverso diversi protocolli prima della verifica delle autorizzazioni. L'articolo SAP va in OVERPASS! Segreti, comandi e dati aziendali per tutti a causa di una gravissima RCE proviene da Red Hot Cyber .

Critical Vulnerabilities in SAP Kernel and NetWeaver Message Server History: 09/09/2026 --- v1.0 -- Initial publication. Summary On 8 September 2026, as part of its September Security Patch Day, SAP released Security Notes addressing two critical vulnerabilities affecting a broad range of SAP products [1][3]. The most severe, CVE-2026-44756 (CVSS 10.0), is a memory corruption vulnerability in SAP Extended Passport (EPP) processing, nicknamed "OVERPASS" by the Onapsis Research Labs (ORL), which discovered and responsibly disclosed it [2][3]. The second, CVE-2026-58240 (CVSS 9.8), nicknamed "S4GET", is a missing authentication check in the SAP NetWeaver Message Server [3][6]. Both are remotely exploitable without authentication. According to the reporting researchers, successful exploitation of either can result in arbitrary operating system command execution under the account that owns the SAP installation, leading to full compromise of the affected system and the business data it holds [2][6]. CERT-EU strongly recommends applying SAP Security Notes 3747649 and 3759472 as soon as possible [1]. Technical Details CVE-2026-44756 - "OVERPASS" (CVSS 10.0) CVE-2026-44756 is a memory corruption vulnerability in the SAP Kernel library that processes the Extended Passport (EPP), addressed by SAP Security Note 3747649 [1][4]. SAP's CVE record states that boundary validation is missing during the deserialisation of EPP data, and that an unauthenticated attacker can send a crafted network request containing a malformed EPP header, potentially resulting in undefined behaviour and abnormal program termination, with a high impact on confidentiality, integrity, and availability [2][3]. Onapsis, which reported the vulnerability, assesses that successful exploitation allows a remote attacker to execute arbitrary operating system commands on the SAP host with SAP administrative privileges, resulting in full compromise of the underlying SAP business data and processes [2]. CVE-2026-58240 - "S4GET" (CVSS 9.8) CVE-2026-58240 is a missing authentication check in the SAP NetWeaver Message Server (component BC-CST-MS), addressed by SAP Security Note 3759472 [1][5]. The Message Server does not sufficiently validate the authenticity of internal application server components during registration. Consequently, an unauthenticated attacker with network access can register unauthorised components and potentially perform unauthorised actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system [3][5]. Onapsis, which also reported this vulnerability, states that an attacker can promote themselves to a trusted node inside an SAP cluster, that the Message Server propagates that trust to every application server in the cluster, and that a successful attack yields remote code execution as the operating-system user that runs SAP [6]. Onapsis notes the flaw is reachable through the same public port that SAP GUI clients connect to, which cannot be firewalled without breaking end-user logon [6]. Affected Products CVE-2026-44756 -- affected versions [1]: KRNL64NUC 7.22, 7.22EXT KRNL64UC 7.22, 7.22EXT, 7.53, 8.04 KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.16, 9.18, 9.19, 9.20 WEBDISP 9.16, 9.18, 9.19, 9.20 CVE-2026-58240 -- affected versions [1]: KERNEL 9.16, 9.18, 9.19, 9.20 Recommendations CERT-EU strongly recommends following SAP Security Note 3747649 (CVE-2026-44756) and SAP Security Note 3759472 (CVE-2026-58240) to update the affected products to the relevant versions as soon as possible [1].

SAP heeft kwetsbaarheden verholpen in SAP Extended Passport Protocol (EPP) processing library, SAP NetWeaver Message Server, @sap/cds-mtxs NPM library, SAP GUI for Java, SAP ABAP Development Tools voor SAP NetWeaver AS ABAP, SAP Integration Suite, SAP NetWeaver Business Client, SAP Web Dispatcher, Internet Communication Manager, SAP Content Server, SAP S/4HANA Intercompany Matching and Reconciliation module, en SAP Manufacturing Integration and Intelligence. De kwetsbaarheid met kenmerk CVE-2026-44756 heeft CVSS-score van 10. Het betreft een geheugenveiligheidsprobleem in de EPP processing library dat kan worden geactiveerd door niet-geauthenticeerde aanvallers die malformed EPP headers versturen. Deze geheugenbeschadiging kan leiden tot ongedefinieerd gedrag, wat de vertrouwelijkheid, integriteit en beschikbaarheid van de applicatie kan beïnvloeden. De kwetsbaarheid ontstaat door onjuiste verwerking van EPP headers binnen de SAP EPP processing library. Exploitatie vereist geen authenticatie. De kwetsbaarheid met kenmerk CVE-2026-58240 heeft CVSS-score van 9.8. Het betreft het ontbreken van een authenticatiemechanisme bij de registratie van interne applicatieservercomponenten. Hierdoor valideert het systeem niet correct of de componenten legitiem zijn. Een niet-geauthenticeerde aanvaller met netwerktoegang kan hierdoor ongeautoriseerde componenten registreren binnen de Message Server-omgeving. Dit kan leiden tot compromittering van de vertrouwelijkheid, integriteit en beschikbaarheid van de getroffen SAP NetWeaver-systemen. De kwetsbaarheid met kenmerk CVE-2026-76969 heeft CVSS-score van 9.4. De kwetsbaarheid maakt het mogelijk voor niet-geauthenticeerde aanvallers om gevoelige credentials te verkrijgen. Dit kan leiden tot ongeautoriseerde toegang en manipulatie van tenantgegevens. De kwetsbaarheid betreft credential disclosure in multitenant CAP-applicaties en beïnvloedt de vertrouwelijkheid, integriteit en beschikbaarheid van de getroffen systemen. De kwetsbaarheid met kenmerk CVE-2026-66768 heeft CVSS-score van 9.0. De kwetsbaarheid betreft een onjuiste toegangcontrole en het niet correct afdwingen van trust level policies in SAP GUI for Java. Hierdoor kan een aanvaller met lage privileges willekeurige commando's uitvoeren door misbruik te maken van zwakheden in de backend verwerking van trust policies. Dit beïnvloedt de integriteit van het beveiligingsmodel van het systeem. De overige kwetsbaarheden variëren in ernst van middelmatig tot hoog en betreffen diverse beveiligingsproblemen zoals: niet juist uitvoeren van autorisatiecontroles in SAP ABAP Developer Tools XML External Entity (XXE) in SAP Integration Suite onveilige deserialisatie in SAP NetWeaver Business Client geheugenbeschadiging in SAP NetWeaver Application Server for ABAP en ABAP Platform CRLF-injectie door het gebruik van Jetty-componenten in SAP Commerce Cloud informatielek in SAP Web Dispatcher, Internet Communication Manager en SAP Content Server SQL-injectie in SAP S/4HANA (Intercompany Matching and Reconciliation) Server-Side Request Forgery (SSRF) in SAP Manufacturing Integration and Intelligence Deze kwetsbaarheden kunnen leiden tot privilege-escalatie, ongeautoriseerde toegang, informatielekken, gegevensmanipulatie en verstoring van de beschikbaarheid. Meerdere kwetsbaarheden kunnen zonder authenticatie worden uitgebuit. De kwetsbaarheden treffen diverse SAP-componenten, waaronder SAP ABAP Developer Tools, SAP Integration Suite, SAP NetWeaver, SAP Commerce Cloud, SAP Web Dispatcher, SAP S/4HANA en SAP Manufacturing Integration and Intelligence.

SAP has released security updates to address multiple vulnerabilities, including a maximum-severity flaw in SAP Extended Passport (EPP) Processing that could have a severe impact on the confidentiality, integrity, and availability of the application The vulnerability, tracked as CVE-2026-44756 (CVSS score: 10.0), has been described as a case of memory corruption. Discovered and reported by SAP security company Onapsis, it has been codenamed OVERPASS. The flaw, which resides in the SAP kernel's processing of the Extended Passport (EPP), is exploitable remotely and without authentication, and allows bad actors to run arbitrary operating system commands on the SAP host with SAP administrative privileges, leading to a total compromise of the underlying SAP business data and processes. CVE-2026-44756 stems from a missing boundary validation during the deserialization of EPP data, leading to a memory safety violation when processing externally supplied length fields. An unauthenticated attacker can exploit this loophole to send crafted network requests containing a malformed EPP header and trigger unintended behavior and abnormal program termination. "OVERPASS is a flaw in the SAP kernel code that processes this structure. A specially-crafted request sent to an affected system can be abused to take control of the receiving process and, from there, run operating system commands on the host," Onapsis CTO JP Perez-Etchegoyen said. "Because EPP processing is shared kernel code used by more than one protocol, the flaw is reachable from the internet-facing web layer, from the SAP GUI layer every end user connects to, and from the RFC layer that links SAP systems to one another. It is reachable through several SAP components and several communication protocols, none of them requiring credentials, so no single network control can fully mitigate risk." Successful exploitation can permit an attacker to read the SAP secure store to recover database credentials, password hashes and all housed business data; read the live session data of logged-in users; extract stored credentials to move laterally into every other SAP system; and modify application data, system configuration and the SAP binaries. The second critical flaw patched by SAP is CVE-2026-58240 (CVSS score: 9.8), a missing Authentication check in SAP NetWeaver Message Server that unauthenticated attackers with network access can exploit to perform unauthorized actions. Onapsis, which also discovered the vulnerability, has assigned it the name S4GET. "S4GET is a logic flaw, not a misconfiguration," security researcher Pablo 'Partu' Agustin Artuso said. "It is present in SAP's 9.x kernel lines – the kernels that SAP S/4HANA and SAP S/4HANA Cloud Private Edition run on, and potentially other ABAP-based products as well." "What makes it uniquely dangerous is its reachability: the flaw is triggered through the same public port that every SAP GUI client connects to, so it cannot be firewalled away without breaking the end-user logon. Exploitation requires no credentials, no certificate, and no pre-existing misconfiguration. A successful attack yields full remote code execution as adm, the OS-level user that runs SAP, on every application server in the cluster." Two other critical-rated security flaws patched by SAP are as follows - CVE-2026-76969 (CVSS score: 9.4) - A credential disclosure vulnerability in multi-tenant applications using SAP Cloud Application Programming Model (CAP) that allows an unauthenticated attacker to obtain sensitive credentials by sending specially crafted requests, and then use them to replace or delete tenant data. CVE-2026-66768 (CVSS score: 9.0) - An improper access control vulnerability in SAP NetWeaver SAP GUI for Java that allows execution of arbitrary commands on the underlying host. Although none of the security vulnerabilities have been exploited to date, the criticality of the flaws requires immediate attention. Onapsis is recommending that users inventory every SAP system, patch internet-facing systems before internal instances, reduce exposure where possible, and monitor for exploitation attempts. "Ensure you have visibility into your SAP application layer so that attempts to exploit this vulnerability can be detected and investigated while the rollout is in progress," Perez-Etchegoyen said about CVE-2026-44756. "One point is worth stating plainly: SAP authorizations and Segregation of Duties (SoD) controls will not help. The vulnerable code runs before any authentication step, so locking users, tightening roles, enforcing password policies or restricting transaction access has no effect on this attack path."