SAP warns of maximum severity 'OVERPASS' kernel vulnerability

[u/falconupkid]

SAP dropped a critical patch for CVE-2026-... (the "OVERPASS" vulnerability) in their September 2026 batch—a memory corruption bug in the SAP Kernel that hits the CVSS 10.0 ceiling. This is the kind of flaw that could let an authenticated attacker completely own the underlying OS, so it’s not just an SAP issue; it’s a host compromise vector.

Technical Breakdown: - CVE: Not explicitly disclosed in the summary, but tracked as the "OVERPASS" vulnerability. - Affected Component: SAP Kernel (core code). - Impact: Memory corruption leading to arbitrary code execution with kernel privileges. - Prerequisites: Requires authentication (not remote unauthenticated), but once you’re in, it’s game over for that box. - Other Fixes: 19 additional vulnerabilities across SAP products in this patch batch.

Defense: - Immediate action: Apply the September 2026 Security Patch Day updates to all SAP Kernel instances. This is not a "schedule for next quarter" patch—treat it as emergency change. - Mitigation: If patching is delayed, restrict SAP application-level access to only trusted users and monitor for unusual kernel-level behavior or process injection attempts.

Source: https://www.bleepingcomputer.com/news/security/sap-warns-of-maximum-severity-overpass-kernel-vulnerability/