SAP Addresses Maximum-Severity OVERPASS Kernel Vulnerability in September 2026 Security Updates

SAP has addressed 20 vulnerabilities across multiple products in its September 2026 security updates, including a maximum-severity memory corruption flaw in the SAP Kernel code identified as OVERPASS. The OVERPASS vulnerability affects the SAP Kernel and could allow an attacker to execute arbitrary code or escalate privileges in kernel mode, posing a critical risk to the confidentiality, integrity, and availability of affected systems. SAP has released patches as part of its regular security update cycle. In addition to OVERPASS, 19 other vulnerabilities were addressed, ranging in severity. SAP customers should prioritize applying the latest kernel patches and security advisories to mitigate potential exploitation. The company has not confirmed active exploitation in the wild, but kernel-level memory corruption flaws are typically high-value targets for sophisticated threat actors. Affected products include various SAP applications and databases running on the SAP Kernel. SAP recommends that administrators apply the latest security updates from the SAP Support Portal and verify kernel versions against the provided patches. Additional details, including CVE identifiers and specific product advisories, are expected to be published in SAP's official security bulletins.