9 minute read
Key Takeaways
What you need to know
SAP has recently patched critical vulnerabilities (CVE-2026-44756 and CVE-2026-58240) that are remotely exploitable without credentials, which poses a significant risk to organizations relying on SAP systems.
These unauthenticated flaws, with a CVSS score of 10.0, can threaten vital business data across multiple SAP components and protocols, making the urgency of addressing these vulnerabilities critical for business continuity.
Effective remediation strategies, including step-by-step patch application and protective measures for SAP environments, are essential for safeguarding web applications, SAP GUI, and RFC layers, impacting IT security teams and business operations.
On Demand
Watch Onapsis and SAP talk through September’s Vulnerabilities.
On September Patch Tuesday, SAP patched multiple HotNews, including critical vulnerabilities that are remotely exploitable without credentials. Watch Onapsis and SAP in this joint webinar where we will provide guidance to organizations on the latest patches released by SAP, including the critical vulnerabilities CVE-2026-44756 and CVE-2026-58240.
We will go over the SAP Security Notes and the immediate remediation steps required to shield your SAP landscape from exploitation.
Key Takeaways :
Explore related questions
Ask SAPi
- Understand OVERPASS (CVE-2026-44756) and S4GET (CVE-2026-58240): A high level overview of these critical vulnerabilities.
- Impact & Attack Surface: Why an unauthenticated CVSS 10.0 flaw reachable across multiple SAP components and protocols poses an immediate threat to underlying business data.
- Remediation & Mitigation Strategy: Step-by-step guidance on applying patches and protective measures to secure web, SAP GUI, and RFC layers.
To watch the webinar click here!
More Resources
See All Related Content
SAP Security Notes: September 2026 Patch DayOnapsis Research Labs collaborated with SAP to address critical vulnerabilities OVERPASS and S4GET in SAP systems, releasing insights and patch guidance as part of September's security patch updates, which included a total of twenty-two new security notes and highlighted high-priority and HotNews vulnerabilities that require immediate attention.
SAP Security Notes: October 2026 Patch DayIn October, SAP released twenty-one new and updated security patches, including critical vulnerabilities in S/4HANA and Visual Composer that could lead to full system compromise, with significant contributions from Onapsis Research Labs in addressing multiple vulnerabilities.
7 minute read
Onapsis Research Labs Threat Advisory: The New SAP Exploitation Toolkit SAPMAPOn September 15th, researchers released SAPMAP, an open-source toolkit for exploiting SAP vulnerabilities, which includes multiple exploits and a ransomware PoC, prompting urgent security recommendations for SAP users to assess risks and apply patches against potential attacks.
6 minute read
S4GET (CVE-2026-58240): A Critical Pre-Authentication Vulnerability in SAP NetWeaver’s Message ServerOnapsis and SAP have addressed the critical S4GET vulnerability (CVE-2026-58240) in the SAP NetWeaver Message Server, requiring immediate patching as it allows unauthenticated remote code execution without misconfiguration, posing significant risks to organizations using affected SAP kernels.
8 minute read