SAP’s September 2026 Patch Day dropped 19 new security notes on September 8, and four of them carry Critical severity. Three involve the same structural failure: authentication is missing or bypassed before the system checks who is asking. The authentication gap is no longer an open-source middleware story.
The two most severe—CVE-2026-44756 and CVE-2026-58240, both discovered by Onapsis Research Labs through coordinated disclosure with SAP—are pre-authentication flaws in the SAP kernel. They affect the enterprise ERP stack directly: financials, supply chain, HR, customer data. SAP and Onapsis are hosting a joint threat briefing webinar on September 9 at 10:00am EDT.
CVE-2026-44756, named OVERPASS, carries a CVSS score of 10.0. It is a memory corruption vulnerability in SAP Extended Passport (EPP) processing—the tracing structure that clients attach to requests at session open. Because EPP is processed before the session is authenticated, the flaw is reached before any standard SAP security controls—user locks, roles, authorization objects, logon policies—come into play. As Onapsis wrote: “Because EPP is processed as the session opens, every SAP control that decides who may do what, including user locks, roles, authorization objects and logon policies, is evaluated later than the point where the flaw is reached. None of them is in the attacker’s way.”
What makes OVERPASS particularly dangerous is its reach. EPP is shared kernel code, and three entirely separate access vectors reach the same defect: the web layer (HTTP/S), the SAP GUI layer, and the RFC layer. No single network control closes all three. A single kernel patch (SAP Note 3747649) does. Onapsis estimates more than 10,000 Internet-facing SAP systems present a web interface reachable from the public Internet.
CVE-2026-58240, named S4GET, carries a CVSS of 9.8 and hits a different part of the stack with the same result: unauthenticated RCE. It is a logic flaw in the SAP NetWeaver Message Server, the cluster broker that routes SAP GUI logon requests. The flaw is triggered through port 36NN—the same public port every SAP GUI client connects to. Onapsis described the mechanics: “S4GET lets an unauthenticated attacker on the network promote themselves to a trusted node inside an SAP cluster.” The Message Server propagates that trust to every application server in the cluster. The attacker then invokes RFC-callable programs and obtains RCE as the SAP OS-level administrator. The public port cannot be firewalled without breaking end-user logon. SAP Note 3759472 provides the fix.
The other two critical CVEs extend the pattern into cloud and endpoint layers. CVE-2026-76969 (CVSS 9.4) is a credential disclosure flaw in the sap/cds-mtxs library used by multitenant SAP Cloud Application Programming Model applications. An unauthenticated attacker can obtain sensitive credentials and replace or delete tenant data. CVE-2026-66768 (CVSS 9.0) is an improper access control flaw in SAP GUI for Java where a low-privileged attacker can execute arbitrary commands on a victim’s machine through a malicious backend, though it requires user interaction.
These disclosures are the latest data points in a pattern that has run through PaperCut’s two-minute RCE chain, N-able’s third attack wave in six weeks, Microsoft’s two-track Patch Tuesday, and the Cisco FMC and SD-WAN authentication bypass cluster. The difference is the target: SAP is the system of record. When authentication fails at the ERP layer, the blast radius includes every financial transaction, every supply chain order, and every HR record the system holds.
The pattern echoes earlier SAP-specific history. The 2022 ICMAD vulnerabilities were also shared kernel code at CVSS 10.0. S4GET mirrors the 2019 10KBLAZE exploits but through the public port rather than the internal one—broader attack surface, same destination. Attackers reverse-engineered patches for the RECON vulnerability (CVE-2020-6287) within 72 hours. The Mandiant 2026 M-Trends report named CVE-2025-31324, a pre-authentication SAP NetWeaver flaw, the most exploited vulnerability of 2025. That window keeps compressing as AI-assisted tooling lowers the reverse-engineering cost.
Standard SAP authorizations and segregation-of-duties controls do not mitigate OVERPASS or S4GET. Both flaws are reached before the application evaluates who is asking. For practitioners running affected kernel versions—OVERPASS spans 7.22 through 9.20; S4GET affects the 9.x lines native to SAP S/4HANA—the only complete fix is the kernel patch. SAP has published a workaround for HTTP traffic in Note 3756304 and an FAQ in Note 3776034. Internet-facing systems go first; internal systems are second in sequence, not second in importance, because the SAP GUI port is open on every application server by design.