SAP Patches Maximum Severity “Overpass” Flaw
Onapsis warns over 10,000 internet-facing SAP systems may be exposed to maximum-severity unauthenticated RCE flaw CVE-2026-44756 in SAP Extended Passport.
Onapsis Research Labs discovered CVE-2026-44756, a memory corruption flaw in SAP Extended Passport (EPP) processing caused by missing boundary validation during deserialization. The bug is reachable from the SAP GUI and RFC layers, is remotely exploitable without authentication by default, and could let attackers run arbitrary OS commands with SAP administrative privileges. No active exploitation was observed at publication. Onapsis also flagged critical S4GET bug CVE-2026-58240 (CVSS 9.8) in the S/4HANA Message Server, credential disclosure CVE-2026-76969 in SAP CAP, and improper access control CVE-2026-66768 in NetWeaver.
- CVE-2026-44756 lives in shared SAP kernel EPP code, reachable via SAP GUI and RFC
- Unauthenticated attackers could gain SAP admin privileges and run arbitrary OS commands
- S4GET bug CVE-2026-58240 (CVSS 9.8) affects S/4HANA Message Server
- CAP credential disclosure CVE-2026-76969 and NetWeaver access control bug CVE-2026-66768 also patched
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-44756 | Unauthenticated buffer overflow in SAP Kernel Extended Passport (EPP) processing | 10.0 | <1% | ||
| CVE-2026-58240 | Unauthenticated Component Registration Flaw in SAP NetWeaver Message Server | 9.8 | <1% | ||
| CVE-2026-66768 | Trust Level Policy Bypass Enables RCE in SAP GUI for Java | 9.0 | <1% | ||
| CVE-2026-76969 | Unauthenticated Credential Theft and Tenant Data Tampering in SAP @sap/cds-mtxs | 9.4 | <1% |
From the original article
2 min read at infosecurity-magazine.com
Onapsis urges SAP customers to patch “Overpass” vulnerability, which has a CVSS score of 10. 0
By Phil Muncaster · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.