1. Basic Information Article Title: S4GET Advisory (CVE-2026-58240): SAP Message Server Flaw Publisher: Onapsis Publication Date: 2026-09-08 Original Source: Onapsis Related Sources: BleepingComputer: SAP warns of OVERPASS and S4GET Related Malware, Groups, CVEs, and Products: CVE-2026-58240, SAP NetWeaver Message Server, SAP Application Server, SAP GUI Priority: Critical 2. Executive Summary S4GET lets an unauthenticated attacker have their own IP treated as a trusted SAP cluster host, then connect from that IP to SAP Gateway and execute OS commands. 3. Attack Flow S4GET exploitation path described by Onapsis; no in-the-wild exploitation observed An attacker sends a crafted request to the Message Server’s client-facing port, 36NN, where NN is the instance number. Message Server accepts the attacker’s IP as trusted and propagates that trust information to application servers in the cluster. The attacker connects from that IP to SAP Gateway and, while treated as an internal host, starts external programs callable through RFC. Commands execute with the privileges of <sid>adm, the OS user running SAP on each server. Subsequent theft or manipulation is a potential impact, not a publicly reported real-world outcome. 4. Attacker Position and Execution Environment An unauthenticated attacker able to reach the Message Server port used by SAP GUI. This could involve internet exposure or access obtained after an internal intrusion. 5. What Users and Administrators May See Users User interaction is not required, but blocking the port as a temporary measure may prevent normal logins. Administrators Inference: Message Server trust information and records of external programs launched by Gateway can provide investigative leads. 6. Success Conditions and Risk Reduction Success Conditions A vulnerable SAP NetWeaver Message Server is running. The attacker can reach the Message Server’s client-facing port and subsequently SAP Gateway. Suspicious trust propagation and server-side commands are not detected and blocked. Failure Conditions and Risk Reduction Apply SAP Security Note 3759472 and verify the actual kernel branch and patch level. Onapsis lists fixed levels of 9.16 PL 100, 9.18 PL 32, 9.19 PL 17, and 9.20 PL 7. Restrict SAP GUI connection sources to managed endpoints, SAProuter, or jump hosts, and remove direct internet reachability. Investigate logs, processes, and file differences across Message Server and all application servers on a common timeline. 7. Potential Impact Command execution as <sid>adm across the cluster. Modification or disruption of SAP applications, configuration, and business data. Credential theft, persistent backdoors, and lateral movement to connected systems. 8. Observable Logs Inference: These are investigation sources and their collection requirements. Email: Where relevant emails exist, preserve the original messages, complete URLs, and delivery records. Proxy/SWG/DNS: There are generally no HTTP logs directly corresponding to this path. Investigate Message Server and Gateway connections separately. Endpoint/EDR: Check external programs launched by Gateway and suspicious process or file operations by <sid>adm on each server. Identity/IdP: Check related accounts for suspicious authentication and session use. Assess successful authentication separately from data retrieval. SaaS/Cloud: For cloud deployments, review audit records for workloads, IAM, and API operations. Network: Trace connections to Message Server port 36NN followed by connections from the same source IP to Gateway. Correlate trust changes with available SAP records and configuration. 9. Assessing Attack Success The following are evidence criteria for an individual investigation. See Facts and Unknowns for the scope of actual observations. Attempt observed (success unconfirmed): Evidence criterion: Confirm abnormal requests to Message Server. User interaction confirmed: Evidence criterion: User interaction is not required. Initial execution confirmed: Evidence criterion: Confirm execution of suspicious external programs launched through Gateway. A trust change or file placement alone is not successful execution. Malware execution or authentication success confirmed: Evidence criterion: Confirm suspicious command execution with <sid>adm privileges. Data theft or session compromise confirmed: Evidence criterion: Confirm unauthorized access to business data, credentials, or configuration. Follow-on compromise confirmed: Evidence criterion: Confirm lateral movement across multiple nodes or to connected SAP systems. 10. Investigation Playbook Inference: Operational recommendations based on publicly described behavior. Trigger: Suspicious changes to trust information, or external program execution originating from Gateway. Initial Checks: Identify the affected host, user, and time, and preserve relevant logs and configuration. For vulnerability incidents, verify the actual version and exposure. Endpoint: Check external programs launched by Gateway and suspicious process or file operations by <sid>adm on each server. Identity and Cloud: Check related accounts for suspicious authentication and session use. Assess successful authentication separately from data retrieval. For cloud deployments, review audit records for workloads, IAM, and API operations. Follow-on Activity: Trace connections to Message Server port 36NN followed by connections from the same source IP to Gateway. Correlate trust changes with available SAP records and configuration. Containment: Restrict suspicious sources from connecting to Message Server and Gateway, and preserve configuration and execution records across the cluster. Review trust information and perform patching and recovery. Classification: These success criteria are for investigations. Distinguish evidence confirmed in the individual environment from publicly reported observations. 11. Defense and Detection Ideas Inference: Operational recommendations based on publicly described behavior. Single Event: Suspicious changes to trust information, or external program execution originating from Gateway. Time-Series Correlation: Correlate Message Server requests, changes to trusted IPs, connections from those IPs to Gateway, and external program launches. Threat Hunting: There are generally no HTTP logs directly corresponding to this path. Investigate Message Server and Gateway connections separately. Trace connections to Message Server port 36NN followed by connections from the same source IP to Gateway. Correlate trust changes with available SAP records and configuration. Logging Gaps: Check retention periods and collection settings. DNS alone does not reveal URL paths, and ordinary network logs do not reveal endpoint-local activity. Missing records do not prove an absence of compromise. Priority Controls: Apply SAP Security Note 3759472 and verify the actual kernel branch and patch level. Onapsis lists fixed levels of 9.16 PL 100, 9.18 PL 32, 9.19 PL 17, and 9.20 PL 7. 12. Facts / Inference / Hypothesis Facts Onapsis named the missing-authentication issue in SAP NetWeaver Message Server S4GET and rates it CVSS 9.8. Without credentials, certificates, or a pre-existing misconfiguration, an attacker can have their IP treated as trusted through Message Server’s client-facing port. “Public port” does not mean internet exposure is required. After trust information propagates through the cluster, the attacker connects from that IP to SAP Gateway and invokes external programs through RFC, resulting in command execution as <sid>adm. According to Onapsis, SAP Security Note 3759472 specifies fixed levels of 9.16 PL 100, 9.18 PL 32, 9.19 PL 17, and 9.20 PL 7. Assess the actual kernel branch and patch level, not just the product release name. Completely blocking the port used for normal SAP GUI connections affects business operations. Source-restricting ACLs reduce exposure but do not replace updates. Onapsis had not observed exploitation in real-world environments at publication. Inference The investigation, detection, and mitigation recommendations are based on publicly described behavior. Their applicability depends on each environment’s collection settings, privileges, and traffic visibility. Hypothesis No additional hypotheses. Unresolved points are listed under Unknowns and Further Investigation. 13. MITRE ATT&CK Mapping T1190 Exploit Public-Facing Application (high confidence): The attacker exploits missing authentication on a reachable Message Server. T1059 Command and Scripting Interpreter (high confidence): Arbitrary commands execute as <sid>adm. T1021 Remote Services (medium confidence): Trust propagation and SAP connections could facilitate follow-on compromise. 14. Unknowns and Further Investigation In-the-wild exploitation and attacker identity. Details of crafted requests and Message Server/Gateway reachability in each environment. The applicable fixed level for each environment should also be checked against SAP Security Note 3759472. 15. Impact on SOCs and Organizations SAP operators should monitor Message Server rather than exempting it as an internal component, and establish visibility into SAP GUI connection sources and cluster traffic. Because closing the port can disrupt business, patching should be the primary control. Prioritize investigation of processes running as <sid>adm and simultaneous changes across multiple nodes. 16. Audience Summaries SOC: Correlate Message Server requests, changes to trusted IPs, connections from those IPs to Gateway, and external program launches. Administrators: Apply SAP Security Note 3759472 and verify the actual kernel branch and patch level. Onapsis lists fixed levels of 9.16 PL 100, 9.18 PL 32, 9.19 PL 17, and 9.20 PL 7. Users: User interaction is not required, but blocking the port as a temporary measure may prevent normal logins.