[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fTlQfgc0xc-qjCqWEf0cG0Uh4DctPXGFBIQRm0FJn3lA":3},{"article":4,"iocs":51,"watch_terms":59,"solutions":60,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"37a2819d-ea92-43fc-9ce9-faa6806cb6e9","2026-011: Critical Vulnerabilities in SAP Kernel and NetWeaver Message Server","2026-011-critical-vulnerabilities-in-sap-kernel-and-netweaver-message-server-51e05f","On 8 September 2026, as part of its September Security Patch Day, SAP released Security Notes addressing two critical vulnerabilities affecting a broad range of SAP products[3]. The most severe, CVE-2026-44756 (CVSS 10.0), is a memory corruption vulnerability in SAP Extended Passport (EPP) processing, nicknamed \"OVERPASS\" by the Onapsis Research Labs (ORL), which discovered and responsibly disclosed it[3]. The second, CVE-2026-58240 (CVSS 9.8), nicknamed \"S4GET\", is a missing authentication check in the SAP NetWeaver Message Server[6]. Both are remotely exploitable without authentication. According to the reporting researchers, successful exploitation of either can result in arbitrary operating system command execution under the account that owns the SAP installation, leading to full compromise of the affected system and the business data it holds[6]. CERT-EU strongly recommends applying SAP Security Notes 3747649 and 3759472 as soon as possible.","SAP has released security notes addressing two critical vulnerabilities, CVE-2026-44756 (OVERPASS) and CVE-2026-58240 (S4GET), discovered by Onapsis Research Labs. Both vulnerabilities are remotely exploitable without authentication and can lead to arbitrary operating system command execution, enabling full compromise of affected SAP systems and their business data. CERT-EU urges immediate application of the relevant SAP Security Notes.","SAP releases patches for two critical vulnerabilities, OVERPASS and S4GET, allowing remote code execution.","https:\u002F\u002Fcert.europa.eu\u002Fpublications\u002Fsecurity-advisories\u002F2026-011\u002F","https:\u002F\u002Fcert.europa.eu\u002Ffiles\u002Fimages\u002Fcerteu_home_share-v2.png","2026-09-09T13:07:59+00:00","2026-10-31T10:00:29.349452+00:00",9,[17,20,22,25,28,31],{"name":18,"type":19},"SAP Extended Passport","product",{"name":21,"type":19},"SAP NetWeaver Message Server",{"name":23,"type":24},"SAP","vendor",{"name":26,"type":27},"Onapsis Research Labs","threat_actor",{"name":29,"type":30},"OVERPASS","campaign",{"name":32,"type":30},"S4GET","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":33,"icon":35,"name":36,"slug":37},null,"Vulnerabilities","vulnerabilities",[39,44,46],{"category":40},{"id":41,"icon":35,"name":42,"slug":43},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":45},{"id":33,"icon":35,"name":36,"slug":37},{"category":47},{"id":48,"icon":35,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52,56],{"type":53,"value":54,"context":55},"cve","CVE-2026-44756","Critical memory corruption vulnerability in SAP Extended Passport processing.",{"type":53,"value":57,"context":58},"CVE-2026-58240","Critical missing authentication check in SAP NetWeaver Message Server.",[23,18,21],{"controls":61,"vendors":149},[62,91,120],{"slug":63,"name":64,"problem":65,"products":66},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[67,75,83],{"vendor_slug":68,"vendor_name":69,"vendor_logo":70,"product_slug":71,"product_name":72,"url":73,"description":74},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":92,"name":93,"problem":94,"products":95},"patch-management","Automated patch management","Known holes get closed in days, not months.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":121,"name":122,"problem":123,"products":124},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",[125,133,141],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"akamai","Akamai","\u002Fvendor-logos\u002Fakamai.png","guardicore-segmentation","Akamai Guardicore Segmentation","https:\u002F\u002Fwww.akamai.com\u002Fproducts\u002Fakamai-guardicore-segmentation","Software-based microsegmentation with traffic visibility.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"illumio","Illumio","\u002Fvendor-logos\u002Fillumio.png","illumio-segmentation","Illumio Segmentation","https:\u002F\u002Fwww.illumio.com\u002Fillumio-segmentation","Maps traffic between workloads and enforces segmentation across data centre, cloud and endpoints.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","zero-trust-endpoint-firewall","Zero Trust Endpoint Firewall","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fzero-trust-endpoint-firewall","Centrally managed host firewall with device-level and dynamic access rules, to limit which machines can talk to each other.",[],{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":162},"critical-unauthenticated-rce-flaws-in-sap-systems-demand-immediate-patching","Critical Unauthenticated RCE Flaws in SAP Systems Demand Immediate Patching","Two critical vulnerabilities in SAP Kernel and NetWeaver Message Server allow remote attackers to execute arbitrary operating system commands without any authentication, enabling full system compromise. Because SAP platforms sit at the heart of enterprise business operations — handling financials, HR, and supply chain data — a successful exploit can expose an organisation's most sensitive assets entirely. The fact that no credentials are required dramatically lowers the bar for attackers, making unpatched internet-facing SAP instances an extremely high-value and accessible target. Delayed patching of enterprise middleware like SAP is a persistent organisational blind spot, often because change-management processes treat ERP updates with excessive caution relative to the risk of leaving critical flaws unaddressed.",[155,156,157,158,159,160,161],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":163,"PCI DSS Requirement 6":164,"NIST SP 800-53 SI-2: Flaw Remediation":165,"OWASP A06:2021 Vulnerable and Outdated Components":166,"CIS Control 7: Continuous Vulnerability Management":167,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":168,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":169},"NIS2 mandates that essential and important entities implement incident handling and vulnerability management measures; the unauthenticated, remotely exploitable nature of these SAP flaws makes rapid patching a direct compliance obligation under this article.","Requirement 6 mandates that organisations protect systems and software from known vulnerabilities through timely patching; SAP systems frequently process payment and financial data, making compliance with this requirement directly relevant to these critical flaws.","SI-2 requires organisations to identify, report, and correct information system flaws; a formal flaw remediation process with prioritisation for critical, unauthenticated RCE vulnerabilities would mandate urgent patching of these SAP issues.","Both CVEs directly reflect the risk of running unpatched, outdated SAP components; OWASP A06 highlights that failing to update critical middleware is one of the most consistently exploited classes of vulnerability.","Regular authenticated scanning of SAP assets against known CVEs and a structured remediation deadline would have flagged these critical flaws immediately upon SAP Security Note publication, enabling timely patching before exploitation.","This control explicitly requires timely identification and remediation of technical vulnerabilities in software; adherence would have ensured the SAP patches were assessed and applied within a risk-appropriate timeframe.","The absence of any authentication requirement for exploitation underlines the need for defence-in-depth controls — such as network-level access restrictions — that would limit which hosts can even reach SAP message server ports, reducing exposure while patching proceeds."]