SAP addressed 20 vulnerabilities across multiple products in its September 2026 security updates, BleepingComputer reported on 8 September 2026.

SAP's CVE record for CVE-2026-44756 (published 8 September 2026, 8:10 am Perth) describes a memory safety vulnerability in the Extended Passport Protocol (EPP) processing library: under specific conditions an unauthenticated attacker could exploit a crafted network request containing a malformed EPP header, potentially resulting in undefined behaviour and abnormal program termination, with a possible high impact on confidentiality, integrity and availability; SAP scores it CVSS 3.1 10.0 and points to SAP Note 3747649.

BleepingComputer reports that the flaw, dubbed OVERPASS by Onapsis researchers who reported it, is a buffer overflow that lets unprivileged attackers run arbitrary commands on vulnerable SAP hosts with administrative privileges and can be exploited over SAP Internet Communication Manager (ICM).

Onapsis CTO JP Perez-Etchegoyen said a targeted search identifies more than 10,000 unique internet-facing IP addresses presenting an SAP web interface, a figure he called conservative. On the same patch day SAP fixed CVE-2026-58240 (S4GET), a critical missing-authentication flaw in the SAP NetWeaver Message Server; Onapsis researcher Pablo Artuso said it is triggered through the same public port every SAP GUI client connects to, so it cannot be firewalled away without breaking user logon, needs no credentials, certificate or misconfiguration, and yields remote code execution as <sid>adm on every application server in the cluster. (sources: SAP CVE record via cve.org; BleepingComputer)

Correction (1 Nov 2026): removed the SecurityWeek link and credit, which this desk cannot read; details that came only from SecurityWeek (the list of SAP products on the vulnerable kernel, database-credential and session impacts, the attack paths via SAP GUI and RFC, CVE-2026-76969 and CVE-2026-66768, and the exploitation note) have been removed. The CVSS score now comes from SAP's CVE record, and the card date stays 8 September 2026, the record's publication date.