Loading vulnerability…
S4GET
S4GET is a missing-authentication vulnerability in SAP NetWeaver Message Server component registration. The server insufficiently validates the authenticity of internal application-server components, allowing an unauthenticated network attacker to register an unauthorized component as a trusted cluster peer. Crafted requests to the public SAP GUI-facing Message Server port can cause attacker-controlled network identity to be trusted across application servers. This trust can subsequently be abused through SAP Gateway to invoke RFC-callable external programs and potentially execute operating-system commands as the SAP instance administrator account, <sid>adm. Affected kernel lines include 9.16, 9.18, 9.19, and 9.20, including those used by SAP S/4HANA and SAP S/4HANA Cloud Private Edition.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Exploitation can compromise the confidentiality, integrity, and availability of the affected SAP environment. Unauthorized trusted components can potentially intercept, modify, redirect, or disrupt inter-component messages. Successful exploitation can also yield operating-system command execution as <sid>adm on application servers across the cluster, enabling business-data theft, transaction manipulation, data destruction, and service disruption.
If you can’t patch tonight, do this now.
Until patching is complete, eliminate unnecessary Internet exposure and restrict access to the public SAP GUI-facing Message Server port to required trusted networks and clients. An external-port connection ACL can provide additional hardening but does not replace patching. Monitor for unexpected component registrations and unauthorized administrative activity. Secure communications and correctly configured secinfo, reginfo, and ms/acl_info ACLs do not prevent the described exploitation path. Restricting only the internal Message Server port is insufficient because S4GET targets the public port; blanket blocking of that port can disrupt legitimate SAP GUI logons.
Patch, then assume compromise.
Apply SAP Security Note 3759472 through the SAP kernel update process. The identified minimum corrected patch levels are kernel 9.16 PL 100, 9.18 PL 32, 9.19 PL 17, and 9.20 PL 7. Inventory affected deployments, verify their installed kernel release and patch level, and confirm that the applicable correction has been deployed. SAP released the fix on September 8, 2026; prioritize Internet-exposed Message Server instances.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
34 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.