SAP Patches CVSS 10.0 Kernel Flaw Enabling Unauthenticated Remote Code Execution
SAP patched CVE-2026-44756 (CVSS 10.0), a critical unauthenticated remote code execution flaw in SAP Extended Passport (EPP) Processing caused by missing boundary validation during EPP data deserialization, leading to memory corruption CVE-2026-58240 (CVSS 9.8), codenamed S4GET, is a missing authentication check in SAP NetWeaver Message Server affecting kernel 9.x lines, enabling full RCE as the <sid>adm user on every application server in the cluster Two additional critical flaws were patched:
Analysis
TL;DR
- SAP patched CVE-2026-44756 (CVSS 10.0), a critical unauthenticated remote code execution flaw in SAP Extended Passport (EPP) Processing caused by missing boundary validation during EPP data deserialization, leading to memory corruption
- CVE-2026-58240 (CVSS 9.8), codenamed S4GET, is a missing authentication check in SAP NetWeaver Message Server affecting kernel 9.x lines, enabling full RCE as the
adm user on every application server in the cluster - Two additional critical flaws were patched: CVE-2026-76969 (CVSS 9.4), a credential disclosure vulnerability in multi-tenant SAP CAP applications, and CVE-2026-66768 (CVSS 9.0), an improper access control flaw in SAP GUI for Java
- All vulnerabilities are reachable without credentials across multiple protocols (web layer, SAP GUI, RFC layer), making single network controls insufficient for mitigation
- Onapsis recommends immediate patching of internet-facing systems first, inventorying all SAP systems, reducing exposure, and monitoring for exploitation attempts while noting that SAP authorizations and SoD controls are ineffective against these flaws
Why It Matters
This is a significant security event for enterprises running SAP S/4HANA and related products, as the patched vulnerabilities allow unauthenticated remote code execution with no credentials, certificates, or pre-existing misconfigurations required. The fact that the vulnerable code runs before any authentication step means traditional SAP security controls like role-based access and Segregation of Duties provide zero protection, forcing organizations to rely on patching and network hardening alone.
Technical Details
- CVE-2026-44756 (OVERPASS, CVSS 10.0): A memory corruption vulnerability in the SAP kernel's EPP processing caused by missing boundary validation during deserialization of externally supplied length fields. Exploitable via crafted network requests across the web layer, SAP GUI layer, and RFC layer, leading to arbitrary OS command execution with SAP administrative privileges.
- CVE-2026-58240 (S4GET, CVSS 9.8): A logic flaw (not a misconfiguration) in SAP NetWeaver Message Server on kernel 9.x lines, where a missing authentication check on the public SAP GUI port allows unauthenticated RCE as
<sid>admacross every application server in the cluster. Cannot be firewalled without breaking end-user logon. - CVE-2026-76969 (CVSS 9.4): Credential disclosure in multi-tenant SAP Cloud Application Programming Model (CAP) applications, allowing unauthenticated attackers to extract sensitive credentials and replace or delete tenant data.
- CVE-2026-66768 (CVSS 9.0): Improper access control in SAP NetWeaver SAP GUI for Java enabling arbitrary command execution on the underlying host.
- All four vulnerabilities were discovered and reported by Onapsis; none have been exploited in the wild to date.
Industry Insight
- Enterprises must treat these vulnerabilities as emergency-patch scenarios, prioritizing internet-facing SAP systems over internal instances, and should not rely on existing SAP authorization frameworks or network segmentation alone for mitigation.
- The reachability of OVERPASS and S4GET through shared kernel code across multiple protocols highlights the risk of centralized vulnerability surfaces in enterprise ERP systems, suggesting organizations should audit all SAP communication paths and reduce unnecessary exposure.
- SAP's kernel 9.x line (powering S/4HANA and S/4HANA Cloud Private Edition) is the primary affected ecosystem, and organizations should inventory all ABAP-based products running these kernels to assess blast radius and plan coordinated patching.
Disclaimer: The above content is generated by AI and is for reference only.