SAP OVERPASS CVE-2026-44756: unauth OS command exec on NetWeaver/Web Dispatcher

OVERPASS: pre-auth memory corruption in the SAP kernel

SAP’s September 2026 Patch Day, with Onapsis Research Labs, shipped Security Note 3747649 for OVERPASS (CVE-2026-44756): a memory-corruption bug in SAP Extended Passport (EPP) processing. Missing boundary validation during deserialization of externally supplied length fields lets an unauthenticated attacker send crafted network requests, such as malformed EPP / sap-passport-style headers, that corrupt kernel memory. SAP and Onapsis say the impact extends to arbitrary operating-system command execution under the SAP administrative OS account. The defective code sits in shared kernel paths used by ICM / NetWeaver ABAP and Java kernels and SAP Web Dispatcher 9.16 (other Web Dispatcher versions and HANA XS–bundled Web Dispatcher are called out as not affected in Onapsis’s summary). No credentials are required; the vulnerable path runs before authorization controls apply.

Same-cycle companion: S4GET (CVE-2026-58240, Note 3759472, CVSS 9.8) is a missing authentication check in the NetWeaver Message Server when registering internal application-server components. It affects modern 9.16 / 9.18 / 9.19 / 9.20 kernels. Onapsis notes the trigger rides the same public port SAP GUI clients use, so firewalling it without breaking logon is impractical.

Exposure estimate: Onapsis commentary relayed by BleepingComputer cites more than 10,000 unique Internet-facing IPs presenting an SAP web interface. Onapsis calls that conservative, since it counts HTTP-reachable systems and undercounts Web Dispatcher. It is an estimate, not a confirmed victim count. Primary coverage does not claim in-the-wild exploitation at disclosure.

Two pre-auth NetWeaver bugs in one Patch Day

ERP kernels and Web Dispatchers run core business processes. Unauthenticated OS command execution there gives ransomware or espionage crews a way in without phishing anyone first. With S4GET in the same release, September’s SAP Patch Day carries two pre-auth bugs that can compromise a cluster through core NetWeaver components.

Apply both notes, then check what faces the internet

• Apply Note 3747649 kernel corrections and SAPWEBDISP.SAR where Web Dispatcher 9.16 is in play.
• Apply Note 3759472 for Message Server / S4GET on 9.x kernels in the same change window when possible.
• Inventory internet-facing ICM and Web Dispatcher listeners; treat Onapsis’s >10k figure as a prioritization estimate, then validate your estate with internal asset data.
• Do not rely only on HTTP workarounds for Web Dispatcher. They are incomplete compared with the kernel patch, and RFC / SAP GUI reachability remains.
• No in-the-wild exploitation has been claimed, but this is a CVSS 10.0 pre-auth RCE. Keep it on the urgent list.

Sources

• SAP September 2026 Security Notes (3747649 / 3759472)
• Onapsis: SAP Security Patch Day September 2026
• BleepingComputer: SAP warns of maximum-severity OVERPASS (includes Onapsis >10k estimate)

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].