SAP has released fixes for two critical pre-authentication vulnerabilities, CVE-2026-44756 (named OVERPASS) and CVE-2026-58240 (named S4GET).
OVERPASS (receiving a CVSS 10.0) disclosed to SAP by Onapsis is a critical flaw in the SAP kernel’s processing of the Extended Passport (EPP). EPP processing is shared kernel code used by more than one protocol, and because of that the flaw is reachable from the Internet-facing web layer, from the SAP GUI layer every end user connects to, and from the RFC layer that links SAP systems to one another. The official fix is available now in SAP Security Note 3747649.
S4GET (receiving a CVSS 9.8) is a logic flaw, not a misconfiguration. The flaw is triggered through the same public port that every SAP GUI client connects to, so it cannot be firewalled away without breaking the end-user logon. Exploitation requires no credentials, no certificate, and no pre-existing misconfiguration. A successful attack yields full remote code execution as adm, the OS-level user that runs SAP, on every application server in the cluster.
Recommendations:
- Apply the relevant SAP security updates immediately, specifically SAP Security Note 3747649** for OVERPASS and SAP Security Note 3759472 for S4GET.
- Prioritize Internet-facing SAP systems, particularly systems exposing web interfaces affected by OVERPASS, before proceeding with the broader internal estate.
References:
