Full Report
A vulnerability has been discovered in SAP Extended Passport (EPP) Processing that could allow for remote code execution. SAP Extended Passport (EPP) Processing is a core system data structure and tracing mechanism within SAP Kernel code used to track, log, and monitor end-to-end communication across distributed SAP and non-SAP landscapes. It is created automatically when a new user session opens and travels via communication protocols like RFC (Remote Function Call) and HTTP from the client to the server. Onapsis explained that, because EPP processing is shared kernel code, the vulnerability is reachable from the SAP GUI layer every end user connects to, and from the RFC layer that links SAP systems to one another. The bug is remotely exploitable without authentication and exists by default in a range of SAP components. Successful exploitation of this vulnerability may allow a remote attacker to run arbitrary operating system commands on the SAP host with SAP administrative privileges, leading to a total compromise of the underlying SAP business data and processes.
Analysis Summary
# Vulnerability: Remote Code Execution in SAP Extended Passport (EPP) Processing
## CVE Details
- **CVE ID:** CVE-2026-44756
- **CVSS Score:** Not explicitly listed in text, but categorized as **High** risk/critical impact.
- **CWE:** Memory safety violation (Missing boundary validation during deserialization)
## Affected Systems
- **Products:** SAP Kernel, SAP Web Dispatcher, SAP Internet Communication Manager (ICM), and SAP Dispatcher.
- **Versions:**
- **KRNL64NUC:** 7.22, 7.22EXT
- **KRNL64UC:** 7.22, 7.22EXT, 7.53, 8.04
- **WEBDISP:** 9.16, 9.18, 9.19, 9.20
- **KERNEL:** 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.16, 9.18, 9.19, 9.20
- **Configurations:** Exists by default in SAP landscapes as EPP is a core system data structure for tracing and monitoring.
## Vulnerability Description
The flaw resides in the SAP Extended Passport (EPP) processing shared kernel code. A boundary validation check is missing during the deserialization of EPP data, specifically when processing externally supplied length fields. An attacker can send a malformed EPP header within a network request, triggering a memory safety violation. Because EPP is used across multiple layers (HTTP, RFC, and SAP GUI), the attack surface is extensive.
## Exploitation
- **Status:** Not currently reported as exploited in the wild; No public PoC mentioned.
- **Complexity:** Low (Remotely exploitable without authentication).
- **Attack Vector:** Network. Reachable via:
- **Web Layer:** HTTP(s) requests via SAP Web Dispatcher/ICM (Fiori, WebGUI, APIs).
- **SAP GUI Layer:** Standard SAP GUI logon protocol via the SAP Dispatcher.
- **RFC Layer:** Remote Function Call connections used for system-to-system integration.
## Impact
- **Confidentiality:** Total (Full compromise of business data).
- **Integrity:** Total (Ability to run arbitrary OS commands with SAP admin privileges).
- **Availability:** Total (Potential for abnormal program termination/DoS and system takeover).
## Remediation
### Patches
- Apply the specific SAP Security Notes issued in the **September 2026** patch cycle. Administrators should update the SAP Kernel and Web Dispatcher to the fixed versions corresponding to their release (e.g., updating to the latest patch level for Kernels 7.22 through 9.20).
### Workarounds
- While no direct configuration workaround for the code flaw is provided, general mitigation involves:
- Segmenting administrative computing resources from the primary network.
- Restricting internet access for core SAP application servers.
- Implementing strict network access control lists (ACLs) for RFC and SAP GUI traffic.
## Detection
- **Indicators of Compromise:** Look for abnormal program terminations (crashes) in the SAP Dispatcher or Web Dispatcher processes.
- **Detection methods:** Monitor for malformed or unusually large EPP headers in network traffic. Review SAP system logs for unauthorized OS command execution or unexpected administrative activity.
## References
- **CVE Record:** hxxps://www.cve.org/CVERecord?id=CVE-2026-44756
- **Onapsis Research:** hxxps://onapsis.com/blog/sap-overpass-remediation/
- **SAP Security Notes:** hxxps://support.sap.com/en/my-support/knowledge-base/security-notes-news/september-2026.html?isu_page=1
- **SAP Documentation:** hxxps://help.sap.com/docs/ABAP_PLATFORM_NEW/753088fc00704d0a80e7fbd6803c8adb/89a03e5e5908448cbe7cce3ddcf214b5.html