SAP patches a kernel flaw that lets unauthenticated requests run OS commands as SAP admin

The people this lands on booked their next kernel window months ago. OVERPASS sits in SAP Extended Passport processing, where Onapsis says boundary validation is missing during deserialization of EPP data, so the code hits a memory safety violation when it processes externally supplied length fields ^[5]. An unauthenticated attacker sends a crafted network request carrying a malformed EPP header, and the program runs into undefined behavior and terminates abnormally ^[6].

The usual answer to a critical note landing between windows is to block something at the edge and wait. Onapsis wrote that the flaw "is reachable through several SAP components and several communication protocols, none of them requiring credentials, so no single network control can fully mitigate risk" ^[10]. The firm recommends immediate patching, and gives the default presence of the affected code across a wide range of SAP technology components as part of the reason ^[8].

S4GET is a different sort of problem to plan. The NetWeaver Message Server, according to Onapsis, does not sufficiently validate the authenticity of internal application server components during registration, so unauthenticated attackers with network access can register unauthorized components and perform unauthorized actions inside the application environment ^[12]. The flaw is present across the four kernels of SAP's modern family: 9.16, 9.18, 9.19 and 9.20 ^[13][17].

Half of September's list carries one of the top two ratings, five HotNews and six High Priority out of 22 new and updated notes ^[1][16]. Onapsis says its own contribution was eight vulnerabilities covered by six notes, three of them HotNews ^[2]. The post's counts do not quite line up: it gives twenty-two new and updated notes in the summary, then refers to six of the twenty new notes a paragraph later ^[1][3]. It names CVE-2026-44756 and CVE-2026-58240 as the month's critical CVEs without saying which note carries which ^[15].

The two things that sort this queue are whether exploitation needs credentials, and whether a control already running takes the risk to zero before the patch is installed. OVERPASS fails both ^[8][10]. The month's other 10.0 goes the other way. Note 3771065 updates an SAP Commerce Cloud Data Hub Adapter note first released on August's patch day to say that unmodified environments are not exposed by default, and it points administrators to an FAQ document for verifying their setup ^[14].