SAP Patches CVSS 10.0 Kernel Flaw Enabling Unauthenticated Remote Code Execution
SAP has released security updates to address multiple critical vulnerabilities, including a maximum-severity flaw (CVE-2026-44756, CVSS 10.0) in SAP Extended Passport (EPP) Processing that allows unauthenticated remote code execution. These flaws could lead to a complete compromise of SAP business data and processes, requiring immediate attention and patching.
SAP has released security updates to address multiple critical vulnerabilities within its Extended Passport (EPP) Processing and NetWeaver Message Server components. The most severe flaw, CVE-2026-44756 (CVSS score: 10.0), stems from a memory corruption issue due to a missing boundary validation during the deserialization of EPP data. This allows an unauthenticated attacker to execute arbitrary operating system commands on the SAP host with SAP administrative privileges, potentially leading to a total compromise of SAP business data and processes.
Discovered and named OVERPASS by Onapsis, this vulnerability is particularly dangerous due to its reachability – it can be triggered from several SAP components and communication protocols without requiring any credentials. Successful exploitation could permit an attacker to read the SAP secure store, recover database credentials, and move laterally across the SAP environment.
The second critical flaw, CVE-2026-58240 (CVSS score: 9.8), is a missing Authentication check in SAP NetWeaver Message Server. Assigned the name S4GET by Onapsis, this logic flaw is present in SAP’s 9.x kernel lines – the kernels that SAP S/4HANA and SAP S/4HANA Cloud Private Edition run on – and potentially other ABAP-based products. Exploitation requires no credentials and can be triggered through the same public port used by SAP GUI clients, making it difficult to firewall.
Two additional critical vulnerabilities were also patched: CVE-2026-76969 (CVSS score: 9.4) – a credential disclosure vulnerability in multi-tenant applications using SAP Cloud Application Programming Model (CAP), and CVE-2026-66768 (CVSS score: 9.0) – an improper access control vulnerability in SAP NetWeaver SAP GUI for Java, both allowing arbitrary command execution on the underlying host.
Despite the lack of reported exploitation attempts to date, the severity of these flaws necessitates immediate action. Onapsis recommends inventorying all SAP systems, patching internet-facing systems before internal instances, reducing exposure where possible, and monitoring for exploitation attempts. Importantly, standard SAP authorizations and segregation of duties controls are ineffective against this attack path, as the vulnerable code runs before any authentication step.