SAP Security Updates September 2026 – Critical Flaws Patched in SAP NetWeaver, Cloud and Extended Passport

Cybersecuritynews •Abinaya • September 8, 2026

Share: View original

SAP has released its September 2026 Security Patch Day updates, delivering 19 new security notes and one update to a previously issued note. The patches address vulnerabilities across SAP NetWeaver, SAP Extended Passport Processing, SAP Cloud Application Programming Model, SAP S/4HANA, SAP Integration Suite, SAP Commerce Cloud, and other enterprise products. The most severe issue […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Critical OVERPASS Vulnerability in SAP Kernel Requires Immediate Action On September 8, 2026, SAP released security updates addressing 20 vulnerabilities, including a critical memory corruption flaw tracked as CVE-2026-44756, named OVERPASS. This vulnerability allows unauthenticated attackers to execute arbitrary commands on vulnerable SAP systems, leading to full compromise of business data. The flaw affects various SAP components using the Extended Passport (EPP) processing protocol, which is widely implemented across multiple SAP applications. Onapsis estimates over 10,000 Internet-facing SAP systems are potentially exposed to this risk. SAP has not reported any known active exploitation of this vulnerability as of the publication date. Immediate patching is recommended as the vulnerability is reachable through multiple vectors, including web requests and SAP GUI connections. The security updates also address other critical vulnerabilities, including CVE-2026-58240, which involves missing authentication checks in SAP NetWeaver. Organizations are urged to prioritize applying the patches to mitigate risks. 15 sources 76

Extracted Entities

Platforms (6)

SAP Cloud Application Programming Model SAP Commerce Cloud SAP Extended Passport Processing SAP Integration Suite SAP NetWeaver SAP S/4HANA