Critical Vulnerabilities in SAP Kernel and NetWeaver Message Server
On 8 September 2026, as part of its September Security Patch Day, SAP released Security Notes addressing two critical vulnerabilities affecting a broad range of SAP products[3]. The most severe, CVE-2026-44756 (CVSS 10.0), is a memory corruption vulnerability in SAP Extended Passport (EPP) processing, nicknamed "OVERPASS" by the Onapsis Research Labs (ORL), which discovered and responsibly disclosed it[3]. The second, CVE-2026-58240 (CVSS 9.8), nicknamed "S4GET", is a missing authentication check in the SAP NetWeaver Message Server[6]. Both are remotely exploitable without authentication. According to the reporting researchers, successful exploitation of either can result in arbitrary operat
Read at CERT-EU Security Advisories
- Vendor
- SAP
- Product
- NetWeaver
- CVSS
- 10.0
- EPSS
- 0.005 (p45)
- Exposure class
- Web platform
Why it ranks 44 (Notable)
- CVSS 10.0 critical
- Product class: web platform
- Widely deployed vendor product (SAP)
- Covered by 2 independent sources
- CERT coordination
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- CERT-EU Security Advisories (cert.europa.eu)
- CVE-2026-44756 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-58240 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.