CVE-2026-44756: Pre-Auth RCE in SAP EPP Processing (ICM, Web Dispatcher, disp+work)
nullFaktor disclosed pre-authentication remote code execution in SAP EPP processing, tracked as critical CVE-2026-44756.
83
CVE-2026-44756
Unauthenticated buffer overflow in SAP Kernel Extended Passport (EPP) processing
- CVSS 3.1
- 10.0 critical
- EPSS
- <1%p25
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
CVE-2026-44756 is a critical (CVSS 10.0) memory-safety flaw — a classic buffer overflow (CWE-120) — in the Extended Passport Protocol (EPP) processing library of SAP Kernel, the core runtime underlying SAP NetWeaver components (SAP's advisories tie the issue to SAP Kernel and the NetWeaver Message Server). An unauthenticated remote attacker can trigger it by sending a crafted network request containing a malformed EPP header to a system that processes EPP traffic. The malformed header causes undefined behavior and abnormal program termination, and SAP's maximum-severity rating plus vendor coverage of the flaw indicate it can enable unauthenticated remote code execution with high impact on confidentiality, integrity, and availability. Any organization running the affected SAP Kernel/NetWeaver components — essentially typical ABAP-stack SAP deployments — is exposed until patched. No public proof-of-concept is known, the flaw is not in CISA KEV, EPSS estimates only a 0.3% chance of exploitation within 30 days (25th percentile), and fixes shipped in SAP's September 2026 Security Patch Day.
What to do: Apply the SAP Kernel and NetWeaver Message Server fixes released in SAP's September 2026 Security Patch Day (per the 2026-011 advisory covering this flaw), since specific fixed version numbers are not listed in the available data. As interim mitigation, restrict network access to SAP kernel and message-server services to trusted internal networks and identify any SAP instances exposed to the internet. Check SAP's advisory for the exact patch levels applicable to your kernel releases and prioritize externally reachable systems.
| Product | Affected |
|---|---|
| SAP Kernel (Extended Passport Protocol (EPP) processing library) | — |
| SAP NetWeaver (kernel components, including Message Server, per SAP's 2026-011 advisory) | — |
Estimated exposure
mass≈100,000+ SAP systems plausibly affected (EPP/kernel ships with virtually all ABAP-stack NetWeaver deployments; public scans have historically shown tens of… — The vulnerable EPP library is part of SAP Kernel, which is deployed across SAP's roughly 400,000-customer install base with multiple systems per customer, and public internet scans have repeatedly found tens of thousands of exposed SAP…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditions, an unauthenticated attacker could exploit a crafted network request containing a malformed EPP header, potentially resulting in undefined behavior and abnormal program termination. Successful exploitation may have a high impact on the confidentiality, integrity, and availability of the application.
- Weakness
- CWE-120
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
In the news
9 storiesSAP Patches Maximum Severity “Overpass” Flaw
Onapsis warns over 10,000 internet-facing SAP systems may be exposed to maximum-severity unauthenticated RCE flaw CVE-2026-44756 in SAP Extended Passport.
82
SAP warns of maximum severity 'OVERPASS' kernel vulnerability
SAP's September 2026 patches fix maximum-severity kernel flaw CVE-2026-44756 (OVERPASS), letting unauthenticated attackers execute commands on 10,000+ internet-facing SAP systems.
80
SAP Patches Critical Extended Passport Processing Vulnerability
SAP patches CVSS 10.0 flaw CVE-2026-44756 (OVERPASS) enabling unauthenticated RCE in S/4HANA and NetWeaver, plus three other criticals; no in-the-wild exploitation reported.
80
2026-011: Critical Vulnerabilities in SAP Kernel and NetWeaver Message Server
SAP patched two critical flaws, OVERPASS (CVE-2026-44756, CVSS 10.0) and S4GET (CVE-2026-58240), allowing unauthenticated attackers to execute OS commands on SAP hosts.
75
SAP Patches CVSS 10.0 Kernel Flaw Enabling Unauthenticated Remote Code Execution
SAP patched CVE-2026-44756 (CVSS 10.0), an unauthenticated kernel memory corruption allowing OS command execution, plus three other critical flaws.
68
SAP September 2026 Security Update Fixes 4 Critical Vulnerabilities and 15 Other Flaws
SAP's September 2026 Patch Tuesday ships 19 security notes, including four criticals led by a CVSS 10.0 memory-corruption flaw in Extended Passport Processing.
65
SAP Security Updates September 2026 – Critical Flaws Patched in SAP NetWeaver, Cloud and Extended Passport
SAP's September 2026 Patch Day fixes 19 notes including CVE-2026-44756 (CVSS 10.0), unauthenticated memory corruption in SAP Extended Passport Processing kernels.
60
In Other News: Ransomware Developer Sentenced, Plugin4Shell AI Attack, Critical SAP Flaw
SecurityWeek roundup: ransomware developer sentenced, critical SAP flaw CVE-2026-44756, PhantomRaven npm info-stealer, WordPress mass exploitation, and AI agent security findings.
32