# SAP OVERPASS and S4GET: two unauthenticated paths into the ERP core > Two critical SAP vulnerabilities affect the trace passport and the Message Server trust. Analysis of boundaries, scope and unknowns. Published: 2026-11-05 Canonical: https://rootzero.eu/en/research/sap-overpass-s4get-trust-boundaries-2026/ **SAP patches from September 8, 2026.** **OVERPASS, CVE-2026-44756**, and **S4GET, CVE-2026-58240**, are two critical vulnerabilities discovered by Onapsis in shared SAP components. The [CERT-EU](https://cert.europa.eu/publications/security-advisories/2026-011/) summarizes their common point: remote exploitation without authentication can lead to system commands with SAP account rights. However, their mechanisms are not interchangeable: OVERPASS corrupts the memory when processing a trace structure; S4GET turns an external host into a trusted member of the cluster. ## OVERPASS: diagnostic data arrives before login The *Extended Passport* or EPP is used to follow a request through SAP components. [Onapsis](https://onapsis.com/blog/sap-overpass-remediation/) highlights three properties that explain the exposure: the passport is supplied by the client, it passes through HTTP, SAP GUI and RFC in particular, and it is processed at the opening of a session **before the evaluation of user rights**. Memory corruption in this location will therefore not be stopped by a restricted SAP role or by account locking; these checks happen later in the request path. Onapsis gives OVERPASS a possible RCE with SAP administration privileges and a score **10.0**. The laboratory chooses not to publish the malformed field, the faulty offset nor a complete PoC in its initial advisory. We can explain the relationship between client data parser and memory corruption, but not claim to know the exact instruction or payload that hijacks execution. A public exploit subsequently mentioned in a search tool changes the availability of a demo, not the level of detail contained in the initial notice. ## S4GET: cluster trust granted to the wrong host The **Message Server** maintains the list of application servers and routes SAP GUI connections. The **Gateways** of these servers consult the notion of internal host to decide which RFC functions are authorized. According to [Onapsis](https://onapsis.com/blog/s4get-cve-2026-58240-sap-message-server-threat-advisory/), a specially crafted packet to the public Message Server port could make the cluster treat an unauthenticated attacker's IP address as internal. The Message Server then propagated this trust to the cluster; the attacker could call external RFC programs on application servers and execute code as `adm`. Onapsis calls S4GET a product logic defect and specifies that the usual ACL files `secinfo`, `reginfo` and `ms/acl_info` do not govern the vulnerable decision. The targeted port is also used for legitimate SAP GUI connections; closing it without further consequence is generally not a practical mitigation. A separate ACL on external port access may reduce exposure in some environments, but the lab presents it as a hardening, not a replacement for the patch. ## Prove the two risks without confusing their effects In an authorized audit, OVERPASS would require instrumenting EPP analysis on exposed routes, comparing versions before and after patching and establishing reproducible memory corruption before talking about execution control. S4GET would require monitoring, for an external laboratory host, the status assigned by the Message Server and then the decision of each Gateway. Proof of an accepted cluster identity is not yet proof of an executed command; the chain must be traced through to the RFC function. Onapsis has intentionally limited the technical detail in its advisories, and it would be irresponsible to invent the exact bytes of a "SAPMAP" packet without analyzing them. SAP notes are **3747649** for OVERPASS and **3759472** for S4GET. The [SAP Patch Day](https://support.sap.com/en/my-support/knowledge-base/security-notes-news/september-2026.html) lists the affected kernel and Web Dispatcher versions; the inventory must be based on these components, on the versions actually deployed. Onapsis advisories from September 8 indicated that no active exploitation had been observed by their team at the time. The subsequent existence of a PoC does not retrospectively transform this dated statement into proof of an attack. Two boundaries emerge: a diagnostic structure must not be treated as a secure entry before authentication, and membership in a cluster must never be able to be declared by a client of the public port. In both cases, SAP business controls come after the vulnerable decision. **Main sources:** [SAP Patch Day](https://support.sap.com/en/my-support/knowledge-base/security-notes-news/september-2026.html), [OVERPASS by Onapsis](https://onapsis.com/blog/sap-overpass-remediation/), [S4GET by Onapsis](https://onapsis.com/blog/s4get-cve-2026-58240-sap-message-server-threat-advisory/), [CERT-EU summary](https://cert.europa.eu/publications/security-advisories/2026-011/).