S4GET: The Pre-Auth SAP S/4HANA Kernel Flaw with a 9.8 CVSS

On September 8, 2026, SAP released Security Note 3759472 addressing CVE-2026-58240, a pre-authentication vulnerability in the SAP NetWeaver Message Server carrying a CVSS 3.1 score of 9.8. Discovered by Pablo 'Partu' Agustin Artuso of Onapsis Research Labs and dubbed S4GET, the flaw allows a remote, unauthenticated attacker to register as a trusted node in the SAP cluster, propagate that trust to every application server, and achieve remote code execution with the privileges of the operating-system user sidadm. The attack vector is the same public port 36NN that SAP GUI clients use for daily logons, making network segmentation impractical without disrupting business operations.

The Core Issue: When Legitimate Code Becomes Vulnerable

The SAP NetWeaver Message Server acts as the central broker for request distribution across the cluster: every application server registers with it to receive connections from SAP GUI clients. During this registration phase, the code fails to adequately verify that the requester is actually an authorized internal node. Artuso identified this gap as an intrinsic logic flaw, not a misconfiguration or insufficient hardening. "S4GET is a logic flaw, not a misconfiguration. It is present in SAP's 9.x kernel lines – the kernels that SAP S/4HANA and SAP S/4HANA Cloud Private Edition run on," the researcher stated, as reported by The Hacker News.

This distinction has concrete operational consequences: a configuration-focused security audit will not detect the flaw, because the vulnerable behavior is the intended behavior of the code itself. According to shattered.io, the anomaly lies in the failure to verify the authenticity of application components during registration, allowing a crafted packet to make the attacker's IP address accepted as a trusted cluster node.

How the Attack Chain Works: From Public Port to the OS

Once trust is established, the Message Server automatically propagates it to all connected application servers. The attacker can then invoke RFC (Remote Function Call) functions normally reserved for internal cluster components. These invocations traverse the same legitimate communication channel, rendering the malicious activity invisible to conventional traffic controls.

The end result is remote code execution with the privileges of the sidadm account, the OS-level administrative user that manages the SAP instance. According to CERT-EU, citing the Onapsis analysis, "The Message Server propagates that trust to every application server in the cluster, and that a successful attack yields remote code execution as the operating-system user that runs SAP." The sidadm account holds elevated privileges on the host system: compromising this user equates to full control of the underlying machine.

"What makes it uniquely dangerous is its reachability: the flaw is triggered through the same public port that every SAP GUI client connects to, so it cannot be firewalled away without breaking the end-user logon. Exploitation requires no credentials, no certificate, and no pre-existing misconfiguration."
— Pablo 'Partu' Agustin Artuso, Onapsis Research Labs, cited by The Hacker News

Why Traditional Segmentation Is Not Enough

The severity of S4GET stems not only from the ease of exploitation—the CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H documents network access, low complexity, no privileges required, no user interaction—but from its architectural irreducibility. Port 36NN is not an auxiliary service exposed by mistake: it is the primary channel through which enterprise users access the ERP system daily. Firewalling it or moving it to a segregated VLAN would break business operations.

This characteristic echoes a pattern already observed in the SAP vulnerability landscape. Comparison with 10KBLAZE from 2019 and OVERPASS (CVE-2026-44756, CVSS 10.0) shows how modern ERP systems still inherit design vulnerabilities in internal authentication and trust code. The difference with S4GET is specific: while OVERPASS targeted the SAP Gateway with a different mechanism, S4GET exploits the Message Server and its trust-propagation model to reach the entire cluster from a single entry point.

Organizations running on-premises or Cloud Private Edition environments face a planning dilemma: maintenance windows for patching SAP kernels require weeks of preparation for regression testing and coordination with industrial processes, while effective exposure begins with the vulnerability's publication. Standard SAP controls—authorizations, segregation of duties (SoD), password policies—are ineffective because the attack is entirely pre-authentication.

Immediate Actions

Priority actions for teams responsible for SAP systems focus on three areas: identification, containment, and definitive remediation.

Verify current patch levels. Compare production kernel versions against the minimum secure levels documented in SAP Security Note 3759472: 9.16 PL 100, 9.18 PL 32, 9.19 PL 17, 9.20 PL 7. According to shattered.io and exploit-intel.com, these are the only levels that include the complete fix for the logic flaw.

Map exposure of ports 36NN. Identify which systems expose the Message Server port to the external network or untrusted segments. CERT-EU has flagged reachability through the same port used by SAP GUI clients as a necessary condition for the attack.

Plan patch deployment in the earliest available maintenance cycle. The dossier reveals no alternative temporary workarounds to the definitive fix; the brief documents no intermediate mitigations that preserve operational functionality.

Monitor Message Server logs for anomalous node registrations. The source does not specify pre-built indicators of compromise, but the attack chain leaves traces in the trust propagation that can be identified by auditing registered components.

The Return of Implicit Trust in Critical Systems

S4GET reopens a conversation the enterprise security sector tends to consider settled: the presumed trust between internal components of a distributed system. The Message Server assumes that any component presenting itself for registration is legitimate because the internal network is considered peripherally protected. When that perimeter coincides with the same user-access interface, the assumption collapses with no possibility of reconfiguration.

The vulnerability also documents a discovery cadence that has not slowed in SAP kernels: after 10KBLAZE in 2019 and the pre-authentication vulnerability platform that emerged in 2026, the ERP system's core code continues to hide logic flaws with systemic impact. For organizations maintaining S/4HANA on-premises, the message is that modernization of the business architecture has not automatically eliminated the fragilities of the infrastructure layer.

The near-term EPSS of 0.34% may appear contained, but the structure of the flaw—no credentials, no prerequisites, maximum impact on the host system—makes it technically trivial to automate. The window between patch day and active exploitation, measured in days for previous SAP vulnerabilities, demands a response speed that traditional change-management processes do not always support.

FAQ

Are SAP credentials required to exploit this vulnerability?
No. The flaw is pre-authentication: the attacker needs no username, password, certificates, or prior access.

Can I block the attack with a firewall or Gateway ACLs?
No. The attack port is the same port 36NN used by legitimate SAP GUI clients; blocking it would halt operations. Gateway ACLs are bypassed by the automatic trust propagation from the Message Server.

Are SAP S/4HANA public cloud instances exposed?
The brief does not specify the status of SAP-managed public cloud instances; the documented affected versions are on-premises and Cloud Private Edition with kernels 9.16–9.20.

Sources

• https://shattered.io/it/sap-netweaver-s4get-cve-2026-58240-cvss-9-8/
• https://onapsis.com/blog/s4get-cve-2026-58240-sap-message-server-threat-advisory/
• https://tech-insider.org/sap-overpass-s4get-critical-vulnerabilities-2026/
• https://www.strix.ai/cve/CVE-2026-58240
• https://exploit-intel.com/vuln/CVE-2026-58240
• https://thehackernews.com/2026/09/sap-patches-cvss-100-kernel-flaw.html
• https://forkast.news/saps-september-patch-day-drops-four-critical-cves-three-of-them-bypass-authentication-entirely/
• https://nvd.nist.gov/vuln/detail/CVE-2026-58240
• https://cert.europa.eu/publications/security-advisories/2026-011/
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/september-2026.html?isu_page=1