SAP issues September 2026 patch bundle fixing critical “OVERPASS” kernel flaw and 19 other bugs

SAP announced a September 2026 security update that resolves a total of 20 vulnerabilities across its product suite, the most serious of which is a memory‑corruption defect in the core SAP Kernel code that the company has dubbed “OVERPASS.” The flaw carries a maximum‑severity rating, indicating that successful exploitation could allow an attacker to execute arbitrary code on affected systems.

The kernel vulnerability stems from unchecked memory handling in a low‑level routine used by many SAP applications. Security researchers who first disclosed the issue warned that, if left unpatched, the defect could be leveraged to gain elevated privileges on enterprise servers running SAP’s ERP, S/4HANA, or Business Technology Platform components. SAP’s advisory classifies the risk as “critical,” urging all customers to apply the patch without delay.

In addition to the kernel flaw, the September release addresses 19 other security concerns spanning modules such as SAP NetWeaver, SAP Cloud Platform, and various industry‑specific extensions. The fixes range from moderate‑severity input‑validation errors to low‑impact information‑leakage bugs. SAP’s security bulletin provides detailed CVE identifiers for each issue, enabling administrators to map the patches to their inventory.

The company recommends that organizations follow a staged rollout, beginning with non‑production environments to verify compatibility before updating mission‑critical systems. SAP also advises customers to review their existing hardening guides, enable automatic security updates where possible, and monitor for any anomalous activity that could indicate an attempted exploitation of the “OVERPASS” bug prior to patching.

Experts note that the timing of the announcement aligns with a broader trend of heightened scrutiny on enterprise software supply chains. Over the past year, several high‑profile attacks have targeted ERP platforms, prompting vendors to accelerate vulnerability remediation cycles. SAP’s proactive communication and the inclusion of a clear severity rating aim to give enterprises the information needed to prioritize remediation efforts.

Looking ahead, SAP has indicated that its security team will continue to monitor the landscape for emerging threats and plans to release additional updates as new findings arise. Customers are encouraged to stay subscribed to SAP’s security advisory mailing list and to engage with certified partners for assistance in applying the patches across complex, heterogeneous environments.