INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

SAP Patches Maximum Severity Overpass Flaw

| 2026-09-09 08:15 CRITICAL HIGH VULNERABILITY DISCLOSURE
JSON
Executive Summary
AI-generated
The discovery of the Memory Corruption vulnerability in SAP Extended Passport Processing, tracked as CVE-2026-44756, has sent shockwaves through the cybersecurity community. Onapsis Research Labs, a renowned security research firm, revealed that the flaw was exploited by multiple customers and could be patched with Security Note 3798315. The vulnerabilities, including credential disclosure flaws, improper access control vulnerabilities, and overpass flaws in SAP Patches Maximum Severity "Overpass" Flaw, pose significant risks to internet-facing systems and SAP customers worldwide. As of September 9th, Onapsis urged customers to take immediate action to patch the vulnerabilities, citing a CVSS score of 9.4 for one exploit and 9.0 for another. The incident highlights the importance of timely vulnerability disclosure and prompt patching in preventing devastating cyber attacks.
Technical Mitigations AI-generated
* Implement secure deserialization: Ensure that the SAP Extended Passport (EPP) Processing is properly validated and sanitized to prevent memory corruption vulnerabilities. * Patch CVE-2026-44756 immediately: Urgently patch the "Overpass" kernel vulnerability in SAP systems, as it can be exploited remotely without authentication and has a high CVSS score of 9.8. * Verify credentials before accessing SAP systems: Implement credential validation checks to ensure that only authorized users have access to SAP systems, particularly for multitenant applications using SAP Cloud Application Programming Model (CAP). * Monitor SAP system logs and network traffic: Continuously monitor SAP system logs and network traffic for suspicious activity or potential exploitation attempts. * Implement secure coding practices in SAP development: Ensure that developers follow secure coding practices when writing code for SAP systems, including proper input validation, sanitization, and error handling.
Technical Observables Login Required
Indicators of Compromise (IoCs) Protected

Raw threat telemetry, malicious IP addresses, file hashes, and direct VirusTotal correlation are restricted to authenticated users.

Sign In to View 123 IoCs Create Free Account
se•••@bl•••.•••
hxxp://••••••••••••••••••••
hxxp://••••••••••••••••••••
hxxp://••••••••••••••••••••
hxxp://••••••••••••••••••••
zt•••••.com
tr•••••.io
hu•••••.li
ww•••••.com
10•••••.jpg
10•••••.jpg
10•••••.jpg
10•••••.png
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
ShinyHuntersShinyHunters CVE-2026-44756CVE-2026-44756 CVE-2026-58231CVE-2026-58231 CVE-2026-58240CVE-2026-58240 CVE-2026-66768CVE-2026-66768 CVE-2026-76969CVE-2026-76969
Target & Sectors
DACH DACH NORTH_AMERICA NORTH_AMERICA
Incident Timeline
‎2016 August
Threat actors exploited a maximum severity "Overpass" flaw in SAP Patches to target Windows Server 2016.
tactic T1584.004 - Server
[Image 5: August updates trigger 0xc0000409 errors on Windows Server 2016 August updates trigger 0xc0000409 errors on Windows Server 2016]( * !
infrastructure Windows
[Image 5: August updates trigger 0xc0000409 errors on Windows Server 2016 August updates trigger 0xc0000409 errors on Windows Server 2016]( * !
infrastructure 2016 Windows Server
[Image 5: August updates trigger 0xc0000409 errors on Windows Server 2016 August updates trigger 0xc0000409 errors on Windows Server 2016]( * !
‎November 2021
Ransomware gangs exploited 14 SAP security flaws since November 2021.
tactic Ransomware
Since November 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added 14 SAP security flaws to its list of actively exploited vulnerabilities, including three that were abused by ransomware gangs.
general_metric 14 SAP security flaws
Since November 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added 14 SAP security flaws to its list of actively exploited vulnerabilities, including three that were abused by ransomware gangs.
‎fiscal year 2025
Threat actors exploited a maximum severity "Overpass" flaw in SAP Patches.
target_region Germany
SAP is a German multinational software company that reported total revenues exceeding €36 billion in fiscal year 2025 and provides services to 99 of the 100 largest companies worldwide. !
financial €36 revenues
SAP is a German multinational software company that reported total revenues exceeding €36 billion in fiscal year 2025 and provides services to 99 of the 100 largest companies worldwide. !
general_metric 100 largest companies
SAP is a German multinational software company that reported total revenues exceeding €36 billion in fiscal year 2025 and provides services to 99 of the 100 largest companies worldwide. !
‎2026/08/09
Threat actors used a known maximum-severity vulnerability (CVE-2026-58231) in SAP's Commerce Cloud cloud-based e-commerce platform to gain full remote code execution on every application server.
vulnerability CVE-2026-58231
A successful attack yields full remote code execution as <sid>adm, the OS-level user that runs SAP, on every application server in the cluster." Last month, SAP fixed another maximum-severity vulnerability (CVE-2026-58231) in the Commerce Cloud cloud-based e-commerce platform, which threat intelligence company Defused flagged as actively exploited in attacks days after it was patched.
tactic Remote Code Execution
A successful attack yields full remote code execution as <sid>adm, the OS-level user that runs SAP, on every application server in the cluster." Last month, SAP fixed another maximum-severity vulnerability (CVE-2026-58231) in the Commerce Cloud cloud-based e-commerce platform, which threat intelligence company Defused flagged as actively exploited in attacks days after it was patched.
‎September 8
Threat actors exploited a vulnerability in SAP's Patches, specifically the "Overpass" flaw.
‎September 8, 2026
Threat actors used a known vulnerability in SAP's "OVERPASS" kernel to target the software.
organisation ThreatLocker
[Image 34: ThreatLocker]( * Home * News * Security * SAP warns of maximum severity 'OVERPASS' kernel vulnerability # SAP warns of maximum severity 'OVERPASS' kernel vulnerability By ###### Sergiu Gatlan * September 8, 2026 * 10:55 AM * 0 !
data_breach 0 September
[Image 34: ThreatLocker]( * Home * News * Security * SAP warns of maximum severity 'OVERPASS' kernel vulnerability # SAP warns of maximum severity 'OVERPASS' kernel vulnerability By ###### Sergiu Gatlan * September 8, 2026 * 10:55 AM * 0 !
‎2026/09/08
SAP addressed CVE-2026-58240, a critical missing authentication vulnerability in the SAP NetWeaver Message Server named S4GET.
vulnerability CVE-2026-58240
" ## S4GET,logic flaw in SAP's NetWeaver Message Server Today, SAP also addressed CVE-2026-58240, a critical missing authentication vulnerability in the SAP NetWeaver Message Server named S4GET by Onapsis Research Labs.
tactic T1584.004 - Server
" ## S4GET,logic flaw in SAP's NetWeaver Message Server Today, SAP also addressed CVE-2026-58240, a critical missing authentication vulnerability in the SAP NetWeaver Message Server named S4GET by Onapsis Research Labs.
organisation NetWeaver Message
" ## S4GET,logic flaw in SAP's NetWeaver Message Server Today, SAP also addressed CVE-2026-58240, a critical missing authentication vulnerability in the SAP NetWeaver Message Server named S4GET by Onapsis Research Labs.
‎September 2026
Threat actors exploited a maximum-severity memory corruption flaw in the SAP Kernel code.
organisation Microsoft
[Image 2: Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days]( * !
general_metric 966 flaws
[Image 2: Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days]( * !
general_metric 2 days
[Image 2: Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days Microsoft September 2026 Patch Tuesday fixes 966 flaws, 2 zero-days]( * !
general_metric 20 vulnerabilities
Image 35: SAP SAP has addressed 20 vulnerabilities across multiple products in its September 2026 security updates, including a maximum-severity memory corruption flaw in the SAP Kernel code.
‎2003 - 2026
Threat actors used a vulnerability in SAP Patches to target Social & Feeds.
organisation Social & Feeds
* Advertising * Write for BleepingComputer * Social & Feeds * Changelog Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved []( "Back to Top")
‎2026/09/09
SAP customers are urged to patch the "Overpass" kernel vulnerability, CVE-2026-44756.
organisation SAP the Memory Corruption
The firm’s Onapsis Research Labs (ORL) discovered and responsibly disclosed to SAP the Memory Corruption vulnerability in SAP Extended Passport (EPP) Processing, tracked as CVE-2026-44756.
organisation SAP Extended Passport
The firm’s Onapsis Research Labs (ORL) discovered and responsibly disclosed to SAP the Memory Corruption vulnerability in SAP Extended Passport (EPP) Processing, tracked as CVE-2026-44756.
organisation SAP Security Note
It is patched with SAP Security Note  #3781729 , and could enable execution of arbitrary commands on a victim’s machine Onapsis urged SAP customers to take action immediately, especially to patch CVE-2026-44756.
financial 3781729 Security Note
It is patched with SAP Security Note  #3781729 , and could enable execution of arbitrary commands on a victim’s machine Onapsis urged SAP customers to take action immediately, especially to patch CVE-2026-44756.
organisation the Extended Passport Protocol
Tracked as CVE-2026-44756 and dubbed OVERPASS by Onapsis security researchers who reported it, the vulnerability stems from a classic buffer overflow weakness in the Extended Passport Protocol (EPP) processing library.
organisation SAP Customers
More CVEs for SAP Customers to Patch Onapsis also urged SAP customers to patch CVE-2026-58240, another critical bug, this time with a CVSS score of 9.8.
organisation Patch Onapsis
More CVEs for SAP Customers to Patch Onapsis also urged SAP customers to patch CVE-2026-58240, another critical bug, this time with a CVSS score of 9.8.
organisation CVSS
More CVEs for SAP Customers to Patch Onapsis also urged SAP customers to patch CVE-2026-58240, another critical bug, this time with a CVSS score of 9.8.
organisation SAP Cloud Application Programming Model
Two further vulnerabilities include: A credential disclosure flaw (CVE-2026-76969) in multitenant applications using SAP Cloud Application Programming Model (CAP).
organisation Security Note
It has a CVSS score of 9.4 and is patched with Security Note  #3798315 An improper access control vulnerability (CVE-2026-66768) in SAP NetWeaver with a CVSS score of 9.0.
organisation SAP NetWeaver
It has a CVSS score of 9.4 and is patched with Security Note  #3798315 An improper access control vulnerability (CVE-2026-66768) in SAP NetWeaver with a CVSS score of 9.0.
financial 3798315 Note improper control vulnerability
It has a CVSS score of 9.4 and is patched with Security Note  #3798315 An improper access control vulnerability (CVE-2026-66768) in SAP NetWeaver with a CVSS score of 9.0.
organisation SAP Patches Maximum Severity
SAP Patches Maximum Severity “Overpass” Flaw.
organisation SAP
Over 10,000 internet-facing SAP systems might be vulnerable to a maximum severity vulnerability in the SAP kernel, security vendor Onapsis has warned.
SAP warns of maximum severity 'OVERPASS' kernel vulnerability.
organisation OVERPASS
SAP warns of maximum severity 'OVERPASS' kernel vulnerability.
organisation RFC
Onapsis explained that, because EPP processing is shared kernel code the vulnerability is reachable from the SAP GUI layer every end user connects to, and from the RFC layer that links SAP systems to one another.
organisation the Message
Dubbed “S4GET,” it affects the Message Server in specific versions of SAP S/4HANA and could allow an attacker to gain access to the entire SAP system cluster to remotely execute malicious payloads and arbitrary commands, the firm explained.
organisation ICM
1/1 Skip Ad Continue watching after the ad!Image 36: Loading PodsVisit Advertiser websiteGO TO PAGE Video 1 Video 2 Video 3 Video 4 Video 5 Video 6 Video 7 The flaw can be exploited over SAP Internet Communication Manager (ICM), the networking component of the SAP Application Server that connects the SAP System (SAP NetWeaver Application Server) to the Internet via HTTP, HTTPS, and SMTP.
organisation the SAP Application
1/1 Skip Ad Continue watching after the ad!Image 36: Loading PodsVisit Advertiser websiteGO TO PAGE Video 1 Video 2 Video 3 Video 4 Video 5 Video 6 Video 7 The flaw can be exploited over SAP Internet Communication Manager (ICM), the networking component of the SAP Application Server that connects the SAP System (SAP NetWeaver Application Server) to the Internet via HTTP, HTTPS, and SMTP.
organisation the SAP System
1/1 Skip Ad Continue watching after the ad!Image 36: Loading PodsVisit Advertiser websiteGO TO PAGE Video 1 Video 2 Video 3 Video 4 Video 5 Video 6 Video 7 The flaw can be exploited over SAP Internet Communication Manager (ICM), the networking component of the SAP Application Server that connects the SAP System (SAP NetWeaver Application Server) to the Internet via HTTP, HTTPS, and SMTP.
organisation SAP NetWeaver Application
1/1 Skip Ad Continue watching after the ad!Image 36: Loading PodsVisit Advertiser websiteGO TO PAGE Video 1 Video 2 Video 3 Video 4 Video 5 Video 6 Video 7 The flaw can be exploited over SAP Internet Communication Manager (ICM), the networking component of the SAP Application Server that connects the SAP System (SAP NetWeaver Application Server) to the Internet via HTTP, HTTPS, and SMTP.
organisation SMTP
1/1 Skip Ad Continue watching after the ad!Image 36: Loading PodsVisit Advertiser websiteGO TO PAGE Video 1 Video 2 Video 3 Video 4 Video 5 Video 6 Video 7 The flaw can be exploited over SAP Internet Communication Manager (ICM), the networking component of the SAP Application Server that connects the SAP System (SAP NetWeaver Application Server) to the Internet via HTTP, HTTPS, and SMTP.
infrastructure Microsoft 365
Microsoft 365 phishing BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations]( * !
Get the report ### Related Articles: SAP warns of critical flaws in NetWeaver and Commerce Cloud Webinar: The forgotten Google Workspace access that can lead to a breach Massive Microsoft 365 outage causes auth issues, service failures Nearly 22,000 Microsoft Exchange servers vulnerable to hijack attacks Max severity SAP Commerce Cloud flaw now targeted in attacks *
organisation BigBear Microsoft 365
Microsoft 365 phishing BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations]( * !
organisation MFA
Microsoft 365 phishing BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations]( * !
victims 258 organizations
Microsoft 365 phishing BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations]( * !
organisation NetWeaver
Get the report ### Related Articles: SAP warns of critical flaws in NetWeaver and Commerce Cloud Webinar: The forgotten Google Workspace access that can lead to a breach Massive Microsoft 365 outage causes auth issues, service failures Nearly 22,000 Microsoft Exchange servers vulnerable to hijack attacks Max severity SAP Commerce Cloud flaw now targeted in attacks *
organisation Google Workspace
Get the report ### Related Articles: SAP warns of critical flaws in NetWeaver and Commerce Cloud Webinar: The forgotten Google Workspace access that can lead to a breach Massive Microsoft 365 outage causes auth issues, service failures Nearly 22,000 Microsoft Exchange servers vulnerable to hijack attacks Max severity SAP Commerce Cloud flaw now targeted in attacks *
organisation Microsoft Exchange
Get the report ### Related Articles: SAP warns of critical flaws in NetWeaver and Commerce Cloud Webinar: The forgotten Google Workspace access that can lead to a breach Massive Microsoft 365 outage causes auth issues, service failures Nearly 22,000 Microsoft Exchange servers vulnerable to hijack attacks Max severity SAP Commerce Cloud flaw now targeted in attacks *
infrastructure Windows
[Image 11: How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11]( * !
[Image 12: How to use the Windows Registry Editor How to use the Windows Registry Editor]( * !
[Image 13: How to backup and restore the Windows Registry How to backup and restore the Windows Registry]( * !
[Image 14: How to start Windows in Safe Mode How to start Windows in Safe Mode]( * !
[Image 16: How to show hidden files in Windows 7 How to show hidden files in Windows 7]( * !
[Image 17: How to see hidden files in Windows How to see hidden files in Windows]( * Webinars * Downloads * Latest * Most Downloaded * !
organisation Stack Protection
[Image 11: How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11]( * !
organisation Windows Registry
[Image 12: How to use the Windows Registry Editor How to use the Windows Registry Editor]( * !
organisation the Windows Registry
[Image 13: How to backup and restore the Windows Registry How to backup and restore the Windows Registry]( * !
infrastructure Linux
[Image 9: Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit]( * Tutorials *
organisation APM
[Image 9: Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit]( * Tutorials *
organisation Hackers
[Image 9: Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit]( * Tutorials *
organisation Magento
[Image 3: Adobe fixes critical Magento zero-day exploited to backdoor servers Adobe fixes critical Magento zero-day exploited to backdoor servers]( * !
organisation Adobe
[Image 3: Adobe fixes critical Magento zero-day exploited to backdoor servers Adobe fixes critical Magento zero-day exploited to backdoor servers]( * !
threat_actor ShinyHunters
[Image 4: ShinyHunters hackers claim breach of Florida ShinyHunters hackers claim breach of Florida "DAVID" DMV database]( * !
organisation DMV
[Image 4: ShinyHunters hackers claim breach of Florida ShinyHunters hackers claim breach of Florida "DAVID" DMV database]( * !
organisation DoppelCart
[Image 7: DoppelCart fraud network uses 119,000 fake shops to steal credit cards DoppelCart fraud network uses 119,000 fake shops to steal credit cards]( * !
organisation IP
[Image 31: How to change IP address.jpg) How to change IP address]( * !
organisation safely.jpg
Access the dark web safely.jpg)
organisation EU CRA
Check your EU CRA readiness in 5 questions.
organisation Perez-Etchegoyen
"A targeted search using high-fidelity fingerprints identifies more than 10,000 unique Internet-facing IP addresses presenting an SAP web interface reachable from the public Internet, and that figure is conservative," Onapsis CTO JP Perez-Etchegoyen said on Tuesday.
infrastructure 10,000 unique facing IP addresses
"A targeted search using high-fidelity fingerprints identifies more than 10,000 unique Internet-facing IP addresses presenting an SAP web interface reachable from the public Internet, and that figure is conservative," Onapsis CTO JP Perez-Etchegoyen said on Tuesday.
organisation The Blue Report 2026
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
organisation CTI
[Image 45: CTI Starter Kit + 2026 SANS CTI Survey CTI Starter Kit + 2026 SANS CTI Survey]( * !
organisation Upcoming Webinar
[Image 38: ThreatLocker]( Upcoming Webinar !
organisation ClickFix
Blockchain Over 5,400 hacked sites serve ClickFix payloads stored on the blockchain]( S ponsor Posts * !
organisation Freestar.com
Image 49!Image 50!Image 51!Image 52!Image 53!Image 54!Image 55!Image 56!Image 57!Image 58!Image 59 Freestar.com !
Tactical Metrics
Metrics
financial
3,798,315
Note Improper Control Vulnerability
It has a CVSS score of 9.4 and is patched with Security Note  #3798315 An improper access control vulnerability (CVE-2026-66768) in SAP NetWeaver with a CVSS score of 9.0.
Metrics
financial
3,781,729
Security Note
It is patched with SAP Security Note  #3781729 , and could enable execution of arbitrary commands on a victim’s machine Onapsis urged SAP customers to take action immediately, especially to patch CVE-2026-44756.
Metrics
infrastructure
‎Microsoft 365
Affected Product
Microsoft 365 phishing BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations]( * !
Get the report ### Related Articles: SAP warns of critical flaws in NetWeaver and Commerce Cloud Webinar: The forgotten Google Workspace access that can lead to a breach Massive Microsoft 365 outage causes auth issues, service failures Nearly 22,000 Microsoft Exchange servers vulnerable to hijack attacks Max severity SAP Commerce Cloud flaw now targeted in attacks *
Metrics
victims
258
Organizations
Microsoft 365 phishing BigBear Microsoft 365 phishing service bypassed MFA at 258 organizations]( * !
Metrics
infrastructure
‎Windows
Affected Product
[Image 5: August updates trigger 0xc0000409 errors on Windows Server 2016 August updates trigger 0xc0000409 errors on Windows Server 2016]( * !
[Image 11: How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11]( * !
[Image 12: How to use the Windows Registry Editor How to use the Windows Registry Editor]( * !
[Image 13: How to backup and restore the Windows Registry How to backup and restore the Windows Registry]( * !
[Image 14: How to start Windows in Safe Mode How to start Windows in Safe Mode]( * !
[Image 16: How to show hidden files in Windows 7 How to show hidden files in Windows 7]( * !
[Image 17: How to see hidden files in Windows How to see hidden files in Windows]( * Webinars * Downloads * Latest * Most Downloaded * !
Metrics
infrastructure
2,016
Windows Server
[Image 5: August updates trigger 0xc0000409 errors on Windows Server 2016 August updates trigger 0xc0000409 errors on Windows Server 2016]( * !
Metrics
infrastructure
‎Linux
Affected Product
[Image 9: Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit Hackers breach F5 BIG-IP APM devices to deploy Linux rootkit]( * Tutorials *
Metrics
data_breach
0
September
[Image 34: ThreatLocker]( * Home * News * Security * SAP warns of maximum severity 'OVERPASS' kernel vulnerability # SAP warns of maximum severity 'OVERPASS' kernel vulnerability By ###### Sergiu Gatlan * September 8, 2026 * 10:55 AM * 0 !
Metrics
infrastructure
10,000
Unique Facing Ip Addresses
"A targeted search using high-fidelity fingerprints identifies more than 10,000 unique Internet-facing IP addresses presenting an SAP web interface reachable from the public Internet, and that figure is conservative," Onapsis CTO JP Perez-Etchegoyen said on Tuesday.
Metrics
financial
36,000,000,000
Revenues
SAP is a German multinational software company that reported total revenues exceeding €36 billion in fiscal year 2025 and provides services to 99 of the 100 largest companies worldwide. !
Intelligence Sources
Infosecurity-Magazine 2026-09-09
BleepingComputer 2026-09-08