A critical vulnerability (CVSS 10) in SAP’s kernel code – now allocated CVE-2026-44756 – is probably the worst Onapsis CTO Juan Perez-Etchegoyen has seen, he told Runtime/The Stack today. Almost every enterprise SAP software product is affected by the pre-auth RCE bug.
The bug can be exploited “from the Internet-facing web layer, from the SAP GUI layer every end user connects to, and from the RFC layer that links SAP systems to one another” he said. There are, conservatively, 10,000+ instances publicly exposed, let alone those on private networks.
Patching requires downtime and SAP customers are not the fastest to move. This time, if they want to avoid a world of pain, they need to be.
SAP has a patch out today. SAP security specialist Onapsis – which is calling the bug “OVERPASS” – urges emergency patching and expects patch-diffs to lead to a public POC and exploitation in short order.
With SAP NetWeaver vulnerability CVE-2025-31324 2025’s most exploited vulnerability, according to Mandiant’s M-Trends 2026 report, users should pay heed and patch up fast. More details below.
Edward Targett
On that upbeat note welcome back to Runtime! This is The Stack’s co-founder Ed Targett, stepping in for our Editor-in-Chief and Runtime founder Tom Krazit. Nice to meet you, if we haven't already connected.
Please do forward this email to a friend or colleague. If it was forwarded to you, sign up here to get Runtime for free every week, or level up here.
P.s. We’re moved to a new site on Monday and are still catching a few bugs. Ping an email if you spot one to ed@thestack.technology.
Through a glass, darkly?
OpenAI’s latest full-fat frontier model is now rolling out to enterprise users. Not everyone is wildly excited about it, even if OpenAI is now referring to “alien intelligence.” As The Stack’s Kiera Fields notes, OAI’s concerns about the noticeably reduced “monitorability” of its chain-of-thought reasoning may also cause CTOs in heavily regulated industries concern.
“That’s just a harness/separate toolchain problem” quoth you?
Well, maybe, it’s early days, but we flagged it below regardless.
Kiera Fields
SolarWinds has a new CISO. He's not bothered by the history. He's moisturised, happy, in his lane. We sat down to chat with him and SolarWinds CTO Krishna Sai about how to strike that age-old balance of security and innovation when everyone is chuntering away about new agentic features. (An interesting digression we briefly went down was around AI gateways. SolarWinds, like Bloomberg, opted to build its own. The Kongs and Solos of this world clearly have some work to do... )
Here's what else we talked about...
Edward Targett
More from The Stack
Beijing's OSS hustle: Three of China’s largest tech companies have formally joined the PyTorch Foundation as the country forms closer ties to the international AI industry, amid a deep open-source drive in the country.
Noah Bovenizer
Europe's Mistral gets Korean cash: European AI lab Mistral has raised €3 billion ($3.5 billion) in a Series D round led by Samsung Electronics, in a boost in its struggle to keep up with American frontier labs.
Noah Bovenizer
Larry's in the hotseat over VA imbroglio: Maybe it's not Oracle's fault. But an extremely expensive slow-motion car crash at Veterans Affairs (VA) which seems unending has finally resulted in minor political unrest...
Noah Bovenizer
People moves!
- Goldman has poached Nomura's global CTO.
- Wealth management firm Osaic has appointed Sayee Bellamkonda as its first Chief AI & Technology Officer
- AI lab Mistral has hired Thomas Coudray as its CISO
- Advania UK has hired Annette Murphy as its new CEO
- Datamaran has appointed Bert Sinnema as CTO.
(Want to be featured in our roundup? Mail tom@thestack.technology)
We're also reading...
- Via HBR: Is your AI training the competition?
- Via a16z: The Mathematician’s Guide to AI
- Via arXiv (from LinkedIn) "Does agent memory survive a model upgrade? A controlled study of memory portability"
Finally, a call to action: The Stack (Runtime's owner) is an entirely bootstrapped, journalist-owned publication. We reinvest every cent/penny from subscriptions in independent editorial and events, like our Stack Summit. Membership is $300/year or $30 a month.
Coming up for members, exclusive interviews with HSBC's CTO and Nestle's CIO. We're also hiring a community manager to help make sure, our subscribers, are lovingly looked after. Your support means the world.
