Security Advisory 2026-011
Two unauthenticated remote code execution vulnerabilities in SAP Kernel and NetWeaver Message Server, dubbed OVERPASS and S4GET, allow full system compromise of SAP installations. OVERPASS (CVE-2026-44756) exploits missing boundary validation in SAP Kernel EPP deserialisation to achieve unauthenticated RCE with SAP admin privileges. S4GET (CVE-2026-58240) abuses a missing auth check in the NetWeaver Message Server to register as a trusted cluster node, propagating trust to all application servers and yielding RCE.
Detection / Hunteropenrouter
Immediate Actions
- Apply SAP Security Note 3747649 to patch OVERPASS on all affected SAP Kernel versions.
- Apply SAP Security Note 3759472 to patch S4GET on all affected NetWeaver Message Server instances.
- Prioritise systems with SAP GUI ports exposed to untrusted networks.
Key Takeaways
- CVE-2026-44756 (CVSS 10.0) is a memory corruption in SAP Extended Passport deserialisation, patched by Security Note 3747649.
- CVE-2026-58240 (CVSS 9.8) is a missing authentication check in NetWeaver Message Server component BC-CST-MS, patched by Security Note 3759472.
- S4GET is reachable through the same public port SAP GUI clients use, which cannot be firewalled without breaking logon.
- Both vulnerabilities were discovered and disclosed by Onapsis Research Labs.
- OVERPASS affects KERNEL versions 7.22 through 9.20; S4GET affects KERNEL 9.16 through 9.20.
Attack Chain
- Initial Access: Attacker sends crafted network request with malformed EPP header to SAP Kernel (CVE-2026-44756) or registers unauthorised component with Message Server (CVE-2026-58240)
- Exploitation: Memory corruption or missing auth check triggers undefined behaviour or trust propagation across SAP cluster
- Privilege Escalation: Attacker gains execution as the OS user running SAP, inheriting SAP administrative privileges
- Impact: Full compromise of SAP business data and processes on the affected host
Affected Systems
- SAP KRNL64NUC 7.22, 7.22EXT
- SAP KRNL64UC 7.22, 7.22EXT, 7.53, 8.04
- SAP KERNEL 7.22 through 9.20 (various subsets per CVE)
- SAP WEBDISP 9.16, 9.18, 9.19, 9.20
- SAP NetWeaver Message Server (BC-CST-MS)
Vulnerabilities (CVEs)
| CVE | Product | Severity | Description |
|---|---|---|---|
| CVE-2026-44756 | SAP Kernel (EPP processing) | Critical | Missing boundary validation during EPP deserialisation allows unauthenticated remote code execution. |
| CVE-2026-58240 | SAP NetWeaver Message Server (BC-CST-MS) | Critical | Missing authentication check allows untrusted component registration leading to remote code execution. |
Detection Availability
No detection rules or queries are published in the source article.
Detection Engineering Assessment
Hypotheses are starting points derived from the article, not findings about your environment; validate against your own telemetry.
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | RCE under SAP service account is visible via process telemetry; exploit payload delivery may be opaque. |
| Network Visibility | Low | S4GET uses the same port as legitimate SAP GUI traffic; OVERPASS uses standard SAP protocols. |
| Detection Difficulty | Hard | Exploits use legitimate SAP ports and protocols; distinguishing malicious requests requires deep inspection. |
Hunting Hypotheses
| Hypothesis | Telemetry | Stage | FP Risk |
|---|---|---|---|
| Unexpected OS command execution originating from SAP Kernel or Message Server processes (T1059) indicates exploitation of CVE-2026-44756 or CVE-2026-58240. | EDR process creation and ancestry logs | Execution | Low — SAP processes spawning shells is abnormal |
| New component registration in SAP Message Server from unrecognised hosts (T1190) indicates S4GET exploitation attempts. | SAP Message Server registration logs | Initial Access | Medium — legitimate app server registrations occur during maintenance |
Required Log Sources
- SAP application logs
- SAP Message Server logs
- EDR process telemetry
- Network flow logs to SAP ports
Key Behavioral Indicators
- SAP Kernel process spawning shell or cmd.exe
- Unexpected application server registration in Message Server logs
- SAP service account executing OS commands outside normal baseline
- Abnormal termination of SAP Kernel process following network request
Control Gaps
- Network firewalls cannot block S4GET without breaking SAP GUI logon
- IDS signatures for malformed EPP headers are not publicly available
- Authentication controls on Message Server registration are absent in vulnerable versions
False Positive Assessment
Low — exploitation produces abnormal process execution from SAP service accounts and unexpected component registrations that deviate from baseline.
Recommendations
Suggestions to evaluate against your own environment, tooling, and incident-response procedures — not directives.
Infrastructure Hardening
- Restrict network access to SAP Message Server ports to authorised application servers only where feasible.
- Monitor SAP Kernel process spawns for unexpected child processes indicating exploitation.
- Segment SAP infrastructure from general corporate network to limit lateral movement post-exploitation.
User Protection
- Ensure SAP administrative accounts follow least-privilege principles to limit blast radius.
- Rotate SAP service account credentials after patching if compromise is suspected.
MITRE ATT&CK Mapping
Initial Access
Execution
Plain-Language Summary
SAP released patches for two critical security holes on September 9, 2026. Both let an attacker remotely take control of SAP servers without needing a password. The first, called OVERPASS, corrupts memory in a core SAP component; the second, called S4GET, tricks the SAP Message Server into treating an attacker as a trusted internal server. Apply SAP Security Notes 3747649 and 3759472 immediately to fix both.
- cveCVE-2026-44756Missing boundary validation during EPP deserialisation allows unauthenticated remote code execution.
- cveCVE-2026-58240Missing authentication check allows untrusted component registration leading to remote code execution.