Advisories
SAP Exposes Critical Kernel & Message Server Flaws: CVE-2026-44756 & CVE-2026-58240
SAP’s September Security Patch Day revealed two critical vulnerabilities that can be exploited remotely without authentication. The memory‑corruption flaw in SAP Extended Passport (OVERPASS, CVE‑2026‑44756) and the missing‑auth bug in NetWeaver Message Server (S4GET, CVE‑2026‑58240) both allow attackers to run arbitrary OS commands as the SAP installation user, risking full system takeover. Immediate application of SAP Security Notes 3747649 and 3759472 is mandatory.
On September 8, 2026, SAP rolled out its Security Patch Day updates, addressing two high‑severity flaws that threaten a wide array of SAP environments.
CVE‑2026‑44756 – “OVERPASS”
- Memory corruption in the SAP Extended Passport (EPP) processing module.
- Rated CVSS 10.0, the bug can be triggered remotely without any authentication.
- Successful exploitation grants the attacker the ability to execute arbitrary operating‑system commands under the SAP installation account.
CVE‑2026‑58240 – “S4GET”
- Missing authentication check in the SAP NetWeaver Message Server.
- CVSS score of 9.8, also remotely exploitable without credentials.
- Allows attackers to run OS commands as the SAP installation user, leading to a full compromise of the affected system.
Both vulnerabilities expose a single, dangerous outcome: complete takeover of the host and the data it protects.
In light of these findings, CERT‑EU urges all SAP customers to apply the following Security Notes without delay:
- Security Note 3747649 – fixes the OVERPASS flaw.
- Security Note 3759472 – patches the S4GET issue.
Failure to patch could leave critical business data exposed to remote attackers capable of executing any command on the underlying operating system.
Related vulnerabilities
Critical Cisco Hardening Release: ASA, FTD, FMC Patch Internal Exploits
Cisco’s security team has rolled out a hardening update for its Secure Firewall Adaptive Security Appliance, Threat Defense, and Management Center software, addressing a suite of internally discovered flaws. Eight CVEs (CVE‑2026‑20329 through CVE‑2026‑20336) cover issues ranging from static credential exposure to authentication bypass, with two vulnerabilities already being actively exploited. No workarounds exist; customers must install the patches promptly to mitigate the critical risk.
Read briefing
Cisco Hardens Secure Email Gateway with Critical Patch for Exploited SQL Injection
Cisco rolled out a hardening update for its Secure Email Gateway and Secure Email & Web Manager after an internal audit uncovered several critical flaws, including a live SQL injection exploit. The fix bundles five CVEs (CVE‑2026‑20353, 76440‑76443) into a single patch with no workarounds, demanding immediate action from customers to maintain email security.
Read briefing
Cisco Issues Critical Hardening Patch for Secure Workload – Five CVEs Resolved
Cisco's Secure Workload engineering team released a hardening update in August 2026 after an internal review uncovered five critical vulnerabilities. The patches address CVE‑2026‑20231, CVE‑2026‑20315, CVE‑2026‑20317, CVE‑2026‑20318, and CVE‑2026‑20319. No workarounds are available, so customers must apply the updates immediately.
Read briefing
Cisco Crosswork Hardening Release: Critical CVEs Uncovered in August 2026
Cisco’s Crosswork team has rolled out a hardening update after an internal security audit revealed several critical weaknesses. Four CVEs—CVE‑2026‑20030, CVE‑2026‑20357, CVE‑2026‑20358, and CVE‑2026‑20359—were patched in the new firmware, with no workarounds available. The vulnerabilities were not known to be actively exploited, but the critical rating urges immediate action. Update your Crosswork devices now to stay protected.
Read briefing