Affected Systems

CVE-2026-44756 (CVSS 10.0) affects SAP Kernel versions 7.22–9.20 and WEBDISP 9.16–9.20 across KRNL64NUC, KRNL64UC, and KERNEL components. CVE-2026-58240 (CVSS 9.8) affects SAP NetWeaver Message Server in Kernel 9.16, 9.18, 9.19, 9.20. Both vulnerabilities are remotely exploitable without authentication and affect a broad range of SAP installations.

Exploitation Status

No active exploitation reported. Both vulnerabilities were responsibly disclosed by Onapsis Research Labs. Proof-of-concept details are publicly available in Onapsis blog posts. Exploitation is feasible for skilled attackers with network access to SAP services.

Business Impact

Both vulnerabilities enable unauthenticated remote attackers to execute arbitrary OS commands with SAP administrative privileges, leading to full system compromise and exposure of business-critical data. CVE-2026-44756 exploits memory corruption in Extended Passport processing. CVE-2026-58240 allows attackers to register as trusted cluster nodes via the Message Server, which shares the same port as SAP GUI (cannot be firewalled without breaking user access). Impact includes data theft, business process disruption, and lateral movement within SAP landscapes.

Urgency

🔴 Immediate

Recommended Actions

  • Apply SAP Security Note 3747649 (CVE-2026-44756) and Security Note 3759472 (CVE-2026-58240) immediately to all affected SAP Kernel and NetWeaver Message Server instances.
  • Prioritize patching internet-facing SAP systems and those accessible from untrusted networks; both flaws require no authentication.
  • Review network segmentation and restrict access to SAP Message Server ports (typically 36NN and 39NN) to trusted networks where feasible.
  • Monitor SAP system logs and OS-level audit logs for unusual process execution, unexpected component registrations, or abnormal EPP-related errors.
  • Verify patch deployment using SAP system information (transaction SYSTEM > Status) and confirm Kernel versions match patched releases listed in SAP Security Notes.

---

# Threat Actor Context

Actor Profile

Onapsis Research Labs (ORL) is a security research organization specializing in enterprise application security, particularly SAP and Oracle systems. In this instance, ORL acted as a responsible vulnerability researcher, discovering and privately disclosing two critical remote code execution vulnerabilities in SAP products to the vendor. The organization operates with the motivation of improving enterprise software security through coordinated vulnerability disclosure, allowing vendors to patch flaws before public release. ORL is not a threat actor but rather a defensive security research entity that helps identify systemic risks in widely-deployed enterprise resource planning (ERP) infrastructure.

TTPs (Tactics, Techniques, Procedures)

The disclosed vulnerabilities enable the following attack techniques: Initial Access via T1190 (Exploit Public-Facing Application) - both CVE-2026-44756 and CVE-2026-58240 are remotely exploitable without authentication against internet-facing SAP services. CVE-2026-44756 ("OVERPASS") leverages T1203 (Exploitation for Client Execution) through memory corruption in SAP Extended Passport (EPP) deserialization, with missing boundary validation allowing crafted network requests to trigger arbitrary OS command execution. CVE-2026-58240 ("S4GET") exploits T1078 (Valid Accounts) conceptually through missing authentication checks in the NetWeaver Message Server registration process, allowing attackers to register as trusted internal application server components. Both vulnerabilities result in T1059 (Command and Scripting Interpreter) execution with SAP administrative privileges, leading to T1098 (Account Manipulation) and full system compromise. The S4GET vulnerability is particularly notable as it is reachable through the same public port used by SAP GUI clients, making it unfilterable without disrupting legitimate business operations.

Targets & Patterns

The vulnerabilities affect organizations running SAP Kernel and SAP NetWeaver Message Server across multiple versions (KERNEL 7.22-9.20, KRNL64UC 7.22-8.04, KRNL64NUC 7.22-7.22EXT, WEBDISP 9.16-9.20). Target sectors include any enterprise using SAP ERP systems, which spans financial services, manufacturing, retail, healthcare, government, and critical infrastructure. SAP systems typically contain highly sensitive business data including financial records, customer information, supply chain data, and intellectual property. The broad deployment of affected SAP Kernel versions (spanning releases from approximately 2010-2026) means the attack surface is extensive. Organizations with internet-facing SAP infrastructure are at highest risk, particularly those exposing SAP GUI connection ports (typically TCP 32xx or 33xx ranges) to external networks. The criticality is amplified because successful exploitation yields operating-system level access with SAP administrative privileges, enabling attackers to exfiltrate business-critical data, manipulate financial transactions, or deploy ransomware across the ERP environment.

Historical Context

This disclosure follows established patterns in SAP vulnerability research by Onapsis Research Labs, which has a history of identifying critical flaws in SAP infrastructure. Previous notable ORL disclosures include vulnerabilities in SAP Solution Manager, SAP HANA, and various NetWeaver components. The September 2026 Patch Day release aligns with SAP's monthly security update cadence. The CVSS 10.0 rating for CVE-2026-44756 places it among the most severe SAP vulnerabilities ever disclosed, comparable to historical critical flaws like CVE-2020-6287 (RECON vulnerability, CVSS 10.0) and CVE-2022-22536 (ICMAD vulnerability, CVSS 10.0). The disclosure of two simultaneously exploitable, authentication-bypass RCE vulnerabilities affecting overlapping SAP Kernel versions represents a significant security event for the SAP ecosystem. The responsible disclosure timeline allowed SAP to develop patches before public release, following industry best practices for coordinated vulnerability disclosure.

Defensive Recommendations

  • Apply SAP Security Notes 3747649 (CVE-2026-44756) and 3759472 (CVE-2026-58240) immediately to all affected SAP Kernel versions (7.22-9.20) following SAP's patching guidance
  • Monitor network traffic to SAP systems for anomalous Extended Passport (EPP) header patterns and unauthorized Message Server registration attempts, particularly on SAP GUI ports (TCP 32xx/33xx ranges)
  • Implement network segmentation to restrict SAP system access to authorized networks only, using allowlisting for SAP GUI client source IPs where operationally feasible
  • Enable comprehensive logging for SAP Kernel processes and Message Server component registration events (BC-CST-MS), forwarding logs to SIEM for detection of T1190 exploitation attempts and T1059 command execution anomalies
  • Conduct immediate threat hunting for indicators of compromise including unexpected process execution under SAP service accounts, unauthorized application server registrations in Message Server logs, and abnormal program terminations in SAP work processes since vulnerability disclosure