SAP NetWeaver Has a 9.8 Pre-Auth RCE. The Message Server Is the Door
- The Mess: SAP NetWeaver Message Server has a critical authentication flaw that lets an unauthenticated network attacker impersonate a trusted application server. Onapsis calls the vulnerability S4GET — CVE-2026-58240.
- The Damage: Successful exploitation can lead to remote code execution as
<sid>admacross the SAP application-server cluster. - The Fix: Apply SAP Security Note 3759472 immediately and check every affected SAP kernel installation.
This is not a forgotten test interface or some bizarre optional module.
S4GET lives in the SAP NetWeaver Message Server and abuses the way it determines which application-server components are trusted. SAP rates the vulnerability CVSS 9.8 Critical, with no authentication and no user interaction required. Affected kernel lines include 9.16, 9.18, 9.19 and 9.20.
The interesting part is the trust model
The Message Server sits in the middle of an SAP cluster. It knows which application servers are available and helps route SAP GUI connections.
SAP Gateway then relies on trust information when deciding which systems are allowed to register RFC services or invoke external programs.
S4GET breaks that assumption.
According to Onapsis, an attacker can send a specially crafted packet to the Message Server’s reachable port and make an attacker-controlled IP address appear to be a trusted internal node. The attacker can then reach the SAP Gateway from that address and abuse legitimate RFC functionality.
No password.
No certificate.
No pre-existing configuration mistake.
And that last part matters.
You can’t simply firewall the problem away
The vulnerable path uses the same public-facing port that legitimate SAP GUI clients use to connect to the system.
That makes S4GET particularly nasty for defenders. Blocking the port can also block normal SAP user logons.
Onapsis says the flaw remains exploitable even when commonly used SAP Gateway ACLs such as secinfo, reginfo and ms/acl_info are correctly configured because those controls are not involved early enough in the attack chain.
Once the attacker is accepted as trusted, the attack can progress to remote code execution as <sid>adm — the operating-system account running SAP — across application servers in the cluster.
At that point, this is no longer an application bug.
It is an SAP system compromise.
Who is exposed?
SAP says CVE-2026-58240 affects:
- KERNEL 9.16
- KERNEL 9.18
- KERNEL 9.19
- KERNEL 9.20
The vulnerability affects SAP NetWeaver Message Server deployments using those kernel lines. SAP’s September 2026 Security Patch Day includes the fix in Security Note 3759472.
Onapsis also notes that these kernel lines underpin SAP S/4HANA and SAP S/4HANA Cloud Private Edition environments, with potentially broader exposure across ABAP-based SAP products.
No public exploit — yet
There is one piece of relatively good news: Onapsis said it had not observed exploitation in the wild when its disclosure was published.
That should not be confused with safety.
The vulnerability is public, the mechanics are documented, the severity is 9.8, and the attack requires no credentials. SAP environments are high-value targets precisely because compromising the underlying application infrastructure can expose business data and critical processes.
And SAP vulnerabilities have a history of being reverse-engineered quickly after patches become available.
Bugstoday Opinion
S4GET is the kind of SAP vulnerability defenders hate.
There is no password to rotate. No suspicious user to disable. No broken ACL to hunt down.
The attacker simply needs network access to a component that SAP clients are already expected to reach.
That turns the Message Server into the real perimeter.
Patch it before someone turns the patch into a roadmap for an exploit.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
- SAP Security Patch Day — September 2026 / Security Note 3759472
- CVE-2026-58240 — CVE Record
- Onapsis Research Labs — S4GET technical advisory
