[CVE-2026-44756]

September 10, 2026

• CERT-EU issued a formal advisory on SAP's two criticals — OVERPASS (CVE-2026-44756, CVSS 10.0, memory corruption in kernel Extended Passport processing, reachable unauthenticated from the web, SAP GUI and RFC layers) and S4GET (CVE-2026-58240, 9.8, missing auth in the NetWeaver Message Server) (CERT-EU; earlier coverage). · Exploited in the Wild

in One Exploit Kit, Four Espionage Crews: BlueMoon Turns Chrome's Patch Gap Into a Shared Weapon

September 9, 2026

• SAP patched two very high-severity pre-auth RCEs: OVERPASS (CVE-2026-44756) in the SAP kernel's Extended Passport processing, allowing unauthenticated command execution, secret recovery and data modification, and S4GET (CVE-2026-58240) in the NetWeaver Message Server. No exploitation reported so far (SecurityWeek, BleepingComputer). · Exploits & Vulnerability Research

in One Phone Call, Zero Clicks: A WeChat Worm Crossed iOS and Android