security_identifier

CVE-2026-58240

Identifier for a missing authentication check in SAP NetWeaver's modern kernel, tracked by Onapsis under the name S4GET.

Known aliases

S4GET

Relationships

No evidence-backed relationships are recorded.

Current clusters

product1 publisher

SAP patches a kernel flaw that lets unauthenticated requests run OS commands as SAP admin

Onapsis, which found the flaw alongside SAP, rates it CVSS 10.0 and recommends immediate patching. A second kernel note in the same batch reaches every S/4HANA 2025 system and any older release already on a current kernel.

Publishers:onapsis.com

Reality

Evidence55
Adoption20
Hype gap+25
Incentives75
Confidence48

security2 publishers

Onapsis counts three network paths to the same unauthenticated SAP kernel flaw

SAP shipped Security Note 3747649 on September 8 for CVE-2026-44756, a memory corruption bug in Extended Passport processing that Onapsis says gives unauthenticated callers command execution as the account owning the SAP install.

Publishers:securityweek.comsocprime.com

Reality

Evidence72
Adoption24
Hype gap+14
Incentives68
Confidence66