Onapsis counts three network paths to the same unauthenticated SAP kernel flaw

Onapsis said the affected components "run under the operating system account that owns the SAP installation, so code execution under it is equivalent to owning the SAP system outright." ^[4] That account reaches the SAP secure store, database credentials, password hashes, business data and the live sessions of logged-in users, and it can rewrite configuration and SAP binaries ^[9]. Credentials stored for other SAP systems sit in the same place, so one compromised host supplies the logins for the next ^[9].

Extended Passport is a tracing structure attached to requests across the SAP ecosystem, and the kernel parses it as the session is created ^[22][6]. "Because EPP is processed as the session opens, every SAP control that decides who may do what, including user locks, roles, authorization objects, and logon policies, is evaluated later than the point where the flaw is reached. None of them is in the attacker's way," Onapsis said ^[5]. SOC Prime adds Segregation of Duties controls and transaction restrictions to the list of controls that never get consulted ^[6].

The flaw can be reached over at least three vectors: web requests, the SAP GUI protocol used by end users, and RFC connections between systems, according to Onapsis ^[7][21]. The vulnerable functionality is implemented by default between ABAP systems ^[7]. Only the patch closes it. SOC Prime says shutting one protocol can leave another path open ^[12].

A single kernel patch closes the known exploitation vectors, according to Onapsis, which recommends inventorying the full landscape and taking internet-facing systems before internal instances ^[11].

Neither Onapsis nor SAP reports evidence of exploitation in the wild ^[13]. SOC Prime tells defenders not to lean on static indicators for that reason, and to watch instead for suspicious requests hitting exposed SAP services, unexpected process execution under SAP operating system accounts, and post-exploitation access to credentials and business data ^[14].

Four of the September notes are critical ^[19]. Alongside OVERPASS, SAP fixed CVE-2026-58240, CVE-2026-76969 in multitenant applications using the Cloud Application Programming Model, and CVE-2026-66768 in NetWeaver ^[16]. Onapsis calls CVE-2026-58240 S4GET: a missing authentication check that lets remote unauthenticated attackers register unauthorized components and perform actions without authorization, resident in SAP's modern kernel, affecting every S/4HANA 2025 and earlier release ^[17]. Two of the four criticals are therefore pre-authentication flaws in kernel code ^[20]. Five further notes cover high-severity bugs in ABAP Developer Tools, Integration Suite, NetWeaver Business Client, NetWeaver and Commerce Cloud (Search And Navigation) ^[18].