SAP Patches CVSS 10.0 Kernel Flaw Enabling Unauthenticated Remote Code Execution

SAP has released security updates addressing multiple critical vulnerabilities, most notably CVE-2026-44756, a CVSS 10.0 memory corruption flaw in the SAP kernel's Extended Passport (EPP) processing. Identified by Onapsis as "OVERPASS," this defect allows unauthenticated attackers to achieve remote code execution with administrative privileges via crafted network requests, potentially compromising business data across SAP S/4HANA and other ABAP-based systems. Additionally, SAP patched CVE-2026-58240 (CVSS 9.8), a missing authentication check in the NetWeaver Message Server dubbed "S4GET" by researchers, along with two other high-severity issues affecting CAP and SAP GUI for Java. Although no active exploitation has been confirmed, administrators are urged to patch internet-facing systems urgently since traditional access controls do not mitigate these kernel-level defects.