SAP OVERPASS and S4GET: two unauthenticated paths into the ERP core

SAP patches from September 8, 2026. OVERPASS, CVE-2026-44756, and S4GET, CVE-2026-58240, are two critical vulnerabilities discovered by Onapsis in shared SAP components. The CERT-EU summarizes their common point: remote exploitation without authentication can lead to system commands with SAP account rights. However, their mechanisms are not interchangeable: OVERPASS corrupts the memory when processing a trace structure; S4GET turns an external host into a trusted member of the cluster.

OVERPASS: diagnostic data arrives before login

The Extended Passport or EPP is used to follow a request through SAP components. Onapsis highlights three properties that explain the exposure: the passport is supplied by the client, it passes through HTTP, SAP GUI and RFC in particular, and it is processed at the opening of a session before the evaluation of user rights. Memory corruption in this location will therefore not be stopped by a restricted SAP role or by account locking; these checks happen later in the request path.

Onapsis gives OVERPASS a possible RCE with SAP administration privileges and a score 10.0. The laboratory chooses not to publish the malformed field, the faulty offset nor a complete PoC in its initial advisory. We can explain the relationship between client data parser and memory corruption, but not claim to know the exact instruction or payload that hijacks execution. A public exploit subsequently mentioned in a search tool changes the availability of a demo, not the level of detail contained in the initial notice.

S4GET: cluster trust granted to the wrong host

The Message Server maintains the list of application servers and routes SAP GUI connections. The Gateways of these servers consult the notion of internal host to decide which RFC functions are authorized. According to Onapsis, a specially crafted packet to the public Message Server port could make the cluster treat an unauthenticated attacker’s IP address as internal. The Message Server then propagated this trust to the cluster; the attacker could call external RFC programs on application servers and execute code as <sid>adm.

Onapsis calls S4GET a product logic defect and specifies that the usual ACL files secinfo, reginfo and ms/acl_info do not govern the vulnerable decision. The targeted port is also used for legitimate SAP GUI connections; closing it without further consequence is generally not a practical mitigation. A separate ACL on external port access may reduce exposure in some environments, but the lab presents it as a hardening, not a replacement for the patch.

Prove the two risks without confusing their effects

In an authorized audit, OVERPASS would require instrumenting EPP analysis on exposed routes, comparing versions before and after patching and establishing reproducible memory corruption before talking about execution control. S4GET would require monitoring, for an external laboratory host, the status assigned by the Message Server and then the decision of each Gateway. Proof of an accepted cluster identity is not yet proof of an executed command; the chain must be traced through to the RFC function. Onapsis has intentionally limited the technical detail in its advisories, and it would be irresponsible to invent the exact bytes of a “SAPMAP” packet without analyzing them.

SAP notes are 3747649 for OVERPASS and 3759472 for S4GET. The SAP Patch Day lists the affected kernel and Web Dispatcher versions; the inventory must be based on these components, on the versions actually deployed. Onapsis advisories from September 8 indicated that no active exploitation had been observed by their team at the time. The subsequent existence of a PoC does not retrospectively transform this dated statement into proof of an attack.

Two boundaries emerge: a diagnostic structure must not be treated as a secure entry before authentication, and membership in a cluster must never be able to be declared by a client of the public port. In both cases, SAP business controls come after the vulnerable decision.

Main sources: SAP Patch Day, OVERPASS by Onapsis, S4GET by Onapsis, CERT-EU summary.