project

SAP NetWeaver

SAP's application server and integration platform, hosting ABAP and Java runtimes underneath many of the company's business applications.

Known aliases

NetWeaver
SAP NetWeaver Message Server

Relationships

No evidence-backed relationships are recorded.

Current clusters

product1 publisher

SAP patches a kernel flaw that lets unauthenticated requests run OS commands as SAP admin

Onapsis, which found the flaw alongside SAP, rates it CVSS 10.0 and recommends immediate patching. A second kernel note in the same batch reaches every S/4HANA 2025 system and any older release already on a current kernel.

Publishers:onapsis.com

Reality

Evidence55
Adoption20
Hype gap+25
Incentives75
Confidence48

security2 publishers

Onapsis counts three network paths to the same unauthenticated SAP kernel flaw

SAP shipped Security Note 3747649 on September 8 for CVE-2026-44756, a memory corruption bug in Extended Passport processing that Onapsis says gives unauthenticated callers command execution as the account owning the SAP install.

Publishers:securityweek.comsocprime.com

Reality

Evidence72
Adoption24
Hype gap+14
Incentives68
Confidence66