What if your most security-critical systems had a front door that opens before you even type the password? That's not a thought experiment. SAP just disclosed a maximum-severity vulnerability that does exactly that -- and it affects a shockingly large portion of the global enterprise landscape.
The vulnerability: CVE-2026-44756
SAP's September 2026 Patch Day brought more than the usual stream of fixes. Tucked inside the bundle was a vulnerability so severe it earned a CVSS score of 10.0 -- the maximum possible. SAP assigned it the codename OVERPASS, and Onapsis Research Labs, who discovered it, pulled no punches in their disclosure: the attack complexity is low, the exploitation requires no credentials, and the blast radius is the entire operating system.
At its core, OVERPASS is a memory corruption bug in how SAP's Extended Passport (EPP) mechanism handles internal tracing data structures. EPP is baked into nearly every modern SAP system -- it collects runtime context for diagnostic and audit purposes. The flaw sits deep in the kernel, where corrupted EPP data can overwrite critical memory regions and create a pathway to arbitrary code execution.
Once exploited, the attacker gains full access to the SAP operating system account (<sid>adm) with administrator-level privileges. No user input, no authentication prompt, no guardrail stands in the way.
Three entry points, zero protection from your firewall
What makes OVERPASS devastating isn't just the severity -- it's the attack surface. SAP disclosed three independent ways to reach the vulnerable code path:
- The web layer -- through the Fiori UI, WebGUI, WebDynpro, Web Dispatcher, or SAP Enterprise Portal.
- The SAP GUI layer -- via standard desktop client connections.
- The RFC layer -- through the Remote Function Call interface used for system-to-system communication.
Here's the part that should make every CISO pause: no single firewall or network rule can block the exploit without disrupting legitimate business traffic. All three vectors carry normal SAP communications -- Fiori requests, GUI sessions, and RFC calls are the lifeblood of your operations. Filtering any of them breaks business continuity.
This is the fundamental problem. Your perimeter defenses assume a vulnerability lives at the application layer, where you can inspect and filter. OVERPASS lives at the kernel layer -- below every control your security stack has.
The companion threat: S4GET (CVE-2026-58240)
OVERPASS didn't arrive alone. SAP also patched CVE-2026-58240, codenamed S4GET, a CVSS 9.8 missing authentication vulnerability in the NetWeaver Message Server. This one allows unauthenticated remote attackers to read and write files across the system. Together with OVERPASS, it forms a devastating one-two punch: one bug opens the door, the other lets you rummage through everything inside.
Two additional critical flaws round out the release -- CVE-2026-76969 (CVSS 9.4, CAP credential disclosure) and CVE-2026-66768 (CVSS 9.0, Java GUI code execution) -- bringing the total critical count to four in a single Patch Day.
Why your GRC and SoD controls won't save you
If your security strategy relies on GRC platforms, segregation of duties (SoD) policies, or audit-logging frameworks to catch this, think again. OVERPASS fires at the kernel level, before any application-layer controls are consulted. No credential exists to validate, no session to hijack, no policy engine to bypass. The exploit happens in the space between the kernel and the hardware -- it's invisible to the entire governance stack.
Researchers are already comparing this to RECON (2020) and 10KBLAZE (2019), the two most damaging SAP bugs of the last decade. RECON exposed 40,000 internet-facing SAP systems through a pre-authentication flaw. OVERPASS is potentially worse: it reaches deeper into the kernel and works across three independent attack paths.
10,000+ internet-facing SAP systems are estimated to be exposed, according to threat intelligence from the current disclosure cycle.
What to do now
SAP has released Security Note 3747649 with the fix. Onapsis has published remediation guidance with specific prioritization. Here's what to do immediately:
- Patch immediately. Prioritize systems exposed on any of the three attack vectors (web, GUI, RFC). This is not a "next maintenance window" fix -- this is a "drop everything" fix.
- Audit RFC configurations. Overly permissive RFC access expands the attack surface. Lock down which systems can communicate via RFC until patches are applied.
- Check for exploitation. Onapsis recommends scanning logs for suspicious EPP-related activity and anomalous
<sid>admprocess execution. - Review SAP Security Roadmap. SAP's broader security strategy now includes a "Secure by Default" initiative and a Bug Bounty Program -- both worth following for enterprises with large SAP footprints.
- Update your incident response plan. If you're running SAP, this vulnerability should be explicitly addressed in your IR playbook. The pre-auth, low-complexity nature means automated exploitation is likely within days.
The bottom line
Enterprise ERP security just hit a new level of urgency. SAP OVERPASS isn't just another vulnerability in a long list -- it's a fundamental reminder that your most critical business systems can be compromised without a single credential being stolen. The window between disclosure and exploitation is shrinking with every Patch Day. The question isn't whether you'll patch -- it's whether you'll patch before someone else decides to test your defenses for you.
This article is based on disclosures from SAP, Onapsis Research Labs, and CERT-EU, published September 8-11, 2026. No active exploitation has been observed as of publication, but proof-of-concept complexity is rated low.