CVE-2026-44756: Pre-Auth RCE in SAP EPP Processing (ICM, Web Dispatcher, disp+work)
nullFaktor disclosed pre-authentication remote code execution in SAP EPP processing, tracked as critical CVE-2026-44756.
nullFaktor published an advisory for CVE-2026-44756, a stack-based buffer overflow in SAP Extended Passport (EPP) processing. The flaw allows pre-authentication remote code execution and is rated Critical under CVSS 4.0. Affected components are ICM, SAP Web Dispatcher, and dialog work processes (disp+work). The disclosure does not state that exploitation has been observed.
- Stack-based buffer overflow in SAP Extended Passport processing
- Pre-authentication remote code execution, impact rated Critical
- Affects ICM, SAP Web Dispatcher, and dialog work processes
- Tracked as CVE-2026-44756; exploitation is not reported
- CVEs
- CVE-2026-44756
- Vendors
- SAP
- Organizations
- nullFaktor
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-44756 | Unauthenticated buffer overflow in SAP Kernel Extended Passport (EPP) processing | 10.0 | <1% |
From the original article
Posted by Raschin Tavakoli via Fulldisclosure on Sep 22 nullFaktor Security Advisory =========================================================== Title: Pre-Authentication Remote Code Execution in SAP Extended Passport (EPP) processing library Affected Components: ICM, SAP Web Dispatcher, dialog work processes Vulnerability: Stack based Buffer Overflow CVE: CVE-2026-44756 Impact: Critical CVSS 4. 0 Vector:...
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.