top of page

SAP Systems Pre-Authentication Vulnerability Actively Exploited (CVE-2026-44756)

September 14th, 2026

Critical

Our Cyber Threat Intelligence Unit is tracking four critical vulnerabilities disclosed by SAP on September 8, 2026, as part of its monthly Security Patch Day. The most severe, CVE-2026-44756 ("OVERPASS"), is a memory corruption vulnerability in the SAP kernel's Extended Passport Processing component, rated CVSS 10.0, and allows an unauthenticated attacker to execute arbitrary operating system commands with SAP administrative privileges. A related vulnerability, CVE-2026-58240 ("S4GET," CVSS 9.8), permits unauthenticated access to an entire SAP system cluster through the NetWeaver Message Server. Two additional critical vulnerabilities, CVE-2026-76969 (CVSS 9.4) and CVE-2026-66768 (CVSS 9.0), affect the SAP Cloud Application Programming Model and SAP GUI for Java respectively. Researchers estimate more than 10,000 internet-facing SAP systems currently run the affected components, and no exploitation has been confirmed at the time of publication. Given SAP's role as a system of record for financial, supply chain, and HR data, organizations running any of the affected components should treat patching as an immediate priority.

Technical Details

CVE-2026-44756 ("OVERPASS"):

  • Severity: Critical | CVSS 3.1: 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H).

  • Threat Type: Memory corruption / buffer overflow (CWE-120).

  • Affected Systems: SAP kernel and Web Dispatcher components shared across S/4HANA, ERP/Business Suite (ECC), NetWeaver, BW/4HANA, Enterprise Portal, PI/PO, and Solution Manager (KRNL64NUC 7.22, 7.22EXT; KRNL64UC 7.22, 7.22EXT, 7.53, 8.04; KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.16, 9.18, 9.19, 9.20; WEBDISP 9.16, 9.18, 9.19, 9.20).

  • Attack Chain:

    • Initial access: An unauthenticated attacker sends a crafted network request containing a malformed Extended Passport (EPP) header.

    • Exploitation: Missing boundary validation during EPP deserialization triggers a memory safety violation.

    • Reachability: Exploitable through the SAP Internet Communication Manager (ICM), reachable via HTTP, HTTPS, and SMTP, as well as through the SAP GUI and RFC layers.

    • Post-exploitation: Successful exploitation allows arbitrary OS command execution with SAP administrative privileges, resulting in full compromise of SAP business data and processes.

    • Authentication note: Because EPP processing occurs before SAP evaluates roles, authorization objects, or logon policies, standard authorization and Segregation of Duties (SoD) controls do not mitigate this attack path.


CVE-2026-58240 ("S4GET"):

  • Severity: Critical | CVSS: 9.8

  • Threat Type: Missing authentication.

  • Affected Systems: SAP NetWeaver Message Server (KERNEL 9.16, 9.18, 9.19, 9.20).

  • Attack Chain:

    • Initial access: Reachable through the same public port used by every SAP GUI client connection.

    • Exploitation: No credentials, certificates, or prior misconfiguration required.

    • Post-exploitation: Allows an unauthenticated attacker to register an unauthorized component within the SAP system cluster and execute arbitrary commands remotely across connected application servers.


CVE-2026-76969:

  • Severity: Critical | CVSS 3.1: 9.4

  • Threat Type: Insufficiently protected credentials (CWE-522).

  • Affected Systems: @sap/cds-mtxs library used in multitenant SAP Cloud Application Programming Model (CAP) applications with tenant extensibility enabled (versions up to 1.18.3, 2.7.6, 3.9.6, 4.0.2).

  • Attack Chain:

    • Initial access: An unauthenticated attacker sends a specially crafted request to a multitenant CAP application with extensibility enabled.

    • Exploitation: Insufficient request validation allows extraction of sensitive credentials.

    • Post-exploitation: Disclosed credentials can be used to replace or delete tenant data.


CVE-2026-66768:

  • Severity: Critical | CVSS: 9.0

  • Threat Type: Improper access control.

  • Affected Systems: SAP GUI for Java (BC-FES-JAV 8.10).

  • Attack Chain:

    • Initial access: Requires user interaction.

    • Exploitation: A low-privileged attacker executes arbitrary commands on a victim's machine through a malicious backend connection.

    • Post-exploitation: Command execution on the compromised endpoint, with potential for further lateral movement.

Image by ThisisEngineering

Impact

  • Broad exposure: Internet-facing SAP systems across all sectors are at risk, given SAP's role as a system of record for financial, supply chain, and HR operations.

  • Full system compromise: CVE-2026-44756 and CVE-2026-58240 can lead to remote code execution and cluster-wide compromise before any authentication control is evaluated.

  • Data integrity loss: CVE-2026-76969 can lead to credential theft and destruction or removal of tenant data in multitenant CAP applications.

  • Lateral movement risk: CVE-2026-66768 allows command execution on a compromised endpoint, creating a foothold for further compromise.

  • Business disruption: Successful exploitation can disrupt financial transactions and supply chain processing.

  • Regulatory exposure: Incidents involving customer or employee data may trigger compliance obligations.

  • Operational cost: Emergency patching and incident response divert resources from normal business operations.

Detection Method

  • Monitor SAP Internet Communication Manager (ICM) and Message Server logs for malformed or abnormally sized EPP headers and unexpected session-initiation requests.

  • Review SAP Security Audit Log (transaction SM20) for unauthenticated connection attempts to internet-facing SAP endpoints.

  • Monitor for unexpected registration of new components or application servers within the NetWeaver Message Server cluster.

  • Watch CAP application logs for anomalous or malformed requests targeting multitenancy/extensibility endpoints, particularly around the @sap/cds-mtxs library.

  • Monitor SAP GUI backend connection configurations for unauthorized or unexpected server entries.

  • No Sigma or YARA rules have been publicly released for these vulnerabilities as of this advisory's publication; prioritize log-based and network-based monitoring until vendor or community detection content becomes available.

Indicators of Compromise

There are no Indicators of Compromises Observed.

mix of red, purple, orange, blue bubble shape waves horizontal for cybersecurity and netwo

Recommendations

  • Apply SAP Security Notes 3747649 (CVE-2026-44756), 3759472 (CVE-2026-58240), 3798315 (CVE-2026-76969), and 3781729 (CVE-2026-66768) immediately.

  • Prioritize patching of internet-facing SAP systems before internal instances.

  • Restrict network exposure of SAP ICM, Message Server, and multitenant CAP application endpoints where immediate patching is not possible.

  • Enforce MFA and review SAP GUI backend connection policies to reduce reliance on user trust.

  • Monitor the log sources listed in Section 4.0 continuously during the patch rollout window.

  • Isolate backups and verify restore procedures for SAP environments given the potential for full system compromise.

  • Maintain a current inventory of all SAP systems and their patch status as an ongoing security practice.

Conclusion

These four critical SAP vulnerabilities, one reaching the maximum CVSS score of 10.0, present a significant and immediate risk to internet-facing SAP environments. Organizations should apply the relevant SAP Security Notes without delay and prioritize monitoring while remediation is in progress.

bottom of page