SAP 'OVERPASS' Kernel Vulnerability: Maximum-Severity Memory Corruption — Detection and Remediation Guide

---
title: SAP Kernel Process Spawning Shell or Script Interpreter
id: 3f8a1c94-7b2e-4d61-a9f3-5c8e2b1d4a67
status: experimental
description: Detects SAP kernel processes (disp+work, gwrd, msg_server, sapstartsrv, sapwebdisp) spawning shells or script interpreters, consistent with post-exploitation activity following memory corruption in the SAP Kernel (OVERPASS).
references:
  - https://www.bleepingcomputer.com/news/security/sap-warns-of-maximum-severity-overpass-kernel-vulnerability/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/09
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/disp+work'
      - '/gwrd'
      - '/msg_server'
      - '/sapstartsrv'
      - '/sapwebdisp'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/python3'
      - '/perl'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/socat'
  condition: selection_parent and selection_child
falsepositives:
  - SAP start/stop scripts invoking shells via sapstartsrv during legitimate instance lifecycle events (review CommandLine for startsap/stopsap wrappers)
level: high
---
title: Windows SAP Kernel Process Spawning Command Shell
id: 8c2d5e71-4a9b-4f38-b6d2-1e7a9c3f5b28
status: experimental
description: Detects SAP kernel executables on Windows (disp+work.exe, gwrd.exe, msg_server.exe, sapstartsrv.exe) spawning cmd.exe, PowerShell, or download utilities, indicating possible post-exploitation of the SAP Kernel OVERPASS vulnerability.
references:
  - https://www.bleepingcomputer.com/news/security/sap-warns-of-maximum-severity-overpass-kernel-vulnerability/
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/09/09
tags:
  - attack.execution
  - attack.t1059.001
  - attack.t1059.003
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\disp+work.exe'
      - '\gwrd.exe'
      - '\msg_server.exe'
      - '\sapstartsrv.exe'
      - '\sapwebdisp.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\certutil.exe'
      - '\bitsadmin.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare SAP administrative wrappers; validate against change records
level: high
---
title: Unexpected External Connection to SAP Gateway or Message Server Ports
id: 5b7e3a29-9d4c-4f18-a2e6-8c1b7d5f3e94
status: experimental
description: Detects network connections from non-trusted sources to SAP Gateway (33xx), Message Server (36xx), or dispatcher (32xx) ports, which are the likely ingress surface for the SAP Kernel OVERPASS memory corruption flaw.
references:
  - https://www.bleepingcomputer.com/news/security/sap-warns-of-maximum-severity-overpass-kernel-vulnerability/
  - https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/09/09
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: network_connection
detection:
  selection_ports:
    DestinationPort|startswith:
      - '32'
      - '33'
      - '36'
  filter_rfc1918:
    DestinationIp|startswith:
      - '10.'
      - '192.168.'
      - '172.16.'
      - '172.17.'
      - '172.18.'
      - '172.19.'
      - '172.2'
      - '172.30.'
      - '172.31.'
  condition: selection_ports and not filter_rfc1918
falsepositives:
  - Legitimate SAP router (saprouter) deployments bridging trusted external networks
  - Load balancer health checks from cloud public ranges
level: medium

// Hunt 1: Abnormal child processes of SAP kernel binaries + kernel crash events
let sapKernelProcs = dynamic(["disp+work", "gwrd", "msg_server", "sapstartsrv", "sapwebdisp", "disp+work.exe", "gwrd.exe", "msg_server.exe", "sapstartsrv.exe", "sapwebdisp.exe"]);
let suspiciousChildren = dynamic(["sh", "bash", "dash", "python", "python3", "perl", "curl", "wget", "nc", "ncat", "socat", "cmd.exe", "powershell.exe", "pwsh.exe", "certutil.exe", "bitsadmin.exe"]);
let ProcEvents = union isfuzzy=true
    (DeviceProcessEvents
     | where InitiatingProcessFileName in~ (sapKernelProcs)
     | where FileName in~ (suspiciousChildren)
     | project TimeGenerated, Host = DeviceName, Parent = InitiatingProcessFileName, Child = FileName, Command = ProcessCommandLine, Account = AccountName, Source = "MDE"),
    (Syslog
     | where Facility =~ "user" or Facility =~ "auth" or SyslogMessage has_any (sapKernelProcs)
     | extend IsCrash = SyslogMessage has_any ("segmentation fault", "SIGSEGV", "core dumped", "signal 11")
     | where IsCrash
     | project TimeGenerated, Host = HostName, Parent = ProcessName, Child = "", Command = SyslogMessage, Account = "", Source = "Syslog-Crash");
ProcEvents
| summarize Events = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Host, Parent, Child, Source
| order by FirstSeen asc;

// Hunt 2: New external sources reaching SAP kernel service ports via CEF/firewall logs
CommonSecurityLog
| where DestinationPort in (3200..3299) or DestinationPort in (3300..3399) or DestinationPort in (3600..3699)
| where ipv4_is_private(SourceIP) == false
| summarize Connections = count(), DestHosts = dcount(DestinationHost), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort
| order by Connections desc;

-- Hunt SAP app servers: kernel process anomalies post-OVERPASS
LET procs = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)(disp\+work|gwrd|msg_server|sapstartsrv|sapwebdisp)'

LET suspicious_kids = SELECT Pid, Ppid, Name, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)^(sh|bash|dash|python3?|perl|curl|wget|nc|ncat|socat|cmd\.exe|powershell\.exe|pwsh\.exe)$'

SELECT Pid, Name AS KernelProc, Username AS KernelUser, CommandLine AS KernelCmd,
       suspicious_kids.Name AS SuspiciousChild, suspicious_kids.CommandLine AS ChildCmd,
       suspicious_kids.Username AS ChildUser, suspicious_kids.CreateTime AS ChildStart
FROM procs
JOIN suspicious_kids ON procs.Pid = suspicious_kids.Ppid

-- Enumerate listening SAP service ports and flag bindings on unexpected interfaces
SELECT Pid, Name, LocalAddress, LocalPort, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE Status =~ 'LISTEN'
  AND (LocalPort >= 3200 AND LocalPort <= 3399 OR LocalPort >= 3600 AND LocalPort <= 3699)
  AND NOT LocalAddress =~ '^(127\.|::1)'
ORDER BY LocalPort

-- Check kernel binary modification times against the last authorized patch deployment
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs='/usr/sap/*/D*/exe/disp+work')
ORDER BY Mtime DESC

#!/bin/bash
# sap-kernel-inventory.sh — Inventory SAP Kernel patch levels for OVERPASS exposure
# Run as root or <sid>adm on each SAP application server

echo "=== SAP Kernel Inventory: $(hostname) — $(date -u) ==="

# Locate all disp+work binaries (one per instance)
for exe in $(find /usr/sap -maxdepth 5 -name 'disp+work' -type f 2>/dev/null); do
    echo ""
    echo "[*] Kernel binary: $exe"
    # Extract kernel release and patch level
    version_out=$("$exe" -version 2>/dev/null | grep -Ei 'kernel release|patch number|patch level|compilation' )
    echo "$version_out"
    # Check binary modification time vs. last known good patch date
    echo "[*] Last modified: $(stat -c '%y' "$exe" 2>/dev/null || stat -f '%Sm' "$exe")"
done

echo ""
echo "=== Exposed kernel service listeners ==="
# Dispatcher 32xx, Gateway 33xx, Message Server 36xx — flag any on public interfaces
ss -tlnp 2>/dev/null | awk 'NR==1 || /:32[0-9][0-9]|:33[0-9][0-9]|:36[0-9][0-9]/'

echo ""
echo "=== Gateway ACL check (secinfo / reginfo) ==="
find /usr/sap -maxdepth 6 \( -name 'secinfo' -o -name 'reginfo' \) 2>/dev/null | while read -r acl; do
    echo "[*] $acl"
    # Flag dangerously permissive wildcard entries
    grep -nE 'PERMIT|HOST=\*|TP=\*' "$acl" | head -5
done

echo ""
echo "[!] ACTION: Compare patch levels above against the September 2026 SAP Security Notes."
echo "[!] Any kernel below the September 2026 patch level is exposed to OVERPASS."