SAP Patches Critical Extended Passport Processing Vulnerability
SAP patches CVSS 10.0 flaw CVE-2026-44756 (OVERPASS) enabling unauthenticated RCE in S/4HANA and NetWeaver, plus three other criticals; no in-the-wild exploitation reported.
CVE-2026-44756 is a CVSS 10.0 memory corruption flaw in Extended Passport (EPP) deserialization, triggered when a user session opens across web, SAP GUI, and RFC vectors. Exploitation yields command execution as the SAP OS account, database credential and password hash recovery, session reading, and data or binary modification; affected products include S/4HANA, ERP/ECC, NetWeaver, Web Dispatcher, and BW/4HANA. Three other criticals were patched: CVE-2026-58240 (S4GET, missing authentication affecting all S/4HANA 2025 and earlier releases), CVE-2026-76969 (CAP credential disclosure), and CVE-2026-66768 (NetWeaver access control). Onapsis and SAP report no indicators of in-the-wild exploitation.
- EPP flaw reachable via web requests, SAP GUI, and RFC as sessions open.
- Code execution runs as the SAP OS account, equivalent to owning the system.
- Affects S/4HANA, ERP/ECC, NetWeaver, Web Dispatcher, BW/4HANA, Enterprise Portal, PI/PO.
- Three other criticals: S4GET missing auth, CAP credential disclosure, NetWeaver access control.
- No indicators of in-the-wild exploitation per Onapsis and SAP.
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-44756 | Unauthenticated buffer overflow in SAP Kernel Extended Passport (EPP) processing | 10.0 | <1% | ||
| CVE-2026-58240 | Unauthenticated Component Registration Flaw in SAP NetWeaver Message Server | 9.8 | <1% | ||
| CVE-2026-66768 | Trust Level Policy Bypass Enables RCE in SAP GUI for Java | 9.0 | <1% | ||
| CVE-2026-76969 | Unauthenticated Credential Theft and Tenant Data Tampering in SAP @sap/cds-mtxs | 9.4 | <1% |
From the original article
2 min read at securityweek.com
Affecting the SAP kernel code, the flaw allows unauthenticated, remote attackers to run arbitrary commands, recover secrets, and modify data. The post SAP Patches Critical Extended Passport Processing Vulnerability appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.