Full Report
SAP has released security updates to address multiple vulnerabilities, including a maximum-severity flaw in SAP Extended Passport (EPP) Processing that could have a severe impact on the confidentiality, integrity, and availability of the application The vulnerability, tracked as CVE-2026-44756 (CVSS score: 10.0), has been described as a case of memory corruption. Discovered and reported by SAP
Analysis Summary
# Vulnerability: SAP Kernel Remote Code Execution (OVERPASS)
## CVE Details
- **CVE ID:** CVE-2026-44756
- **CVSS Score:** 10.0 (Critical)
- **CWE:** Memory Corruption (specifically missing boundary validation during deserialization)
## Affected Systems
- **Products:** SAP Kernel (Extended Passport [EPP] Processing component)
- **Versions:** Multiple versions utilizing shared kernel code (includes systems supporting SAP GUI, RFC, and web-based protocols).
- **Configurations:** Systems reachable via internet-facing web layers, SAP GUI layers, or RFC layers.
## Vulnerability Description
Codenamed **OVERPASS**, this flaw exists in the SAP kernel's processing of the Extended Passport (EPP) structure. It stems from a missing boundary validation during the deserialization of EPP data when processing externally supplied length fields. This leads to a memory safety violation. Because EPP processing is shared kernel code, the flaw is reachable via multiple communication protocols without requiring any prior authentication.
## Exploitation
- **Status:** Not exploited in the wild (as of report date); no public PoC currently cited.
- **Complexity:** Low (requires no credentials or pre-existing misconfiguration).
- **Attack Vector:** Network (Remote).
## Impact
- **Confidentiality:** Total (Ability to read secure stores, database credentials, password hashes, and live session data).
- **Integrity:** Total (Ability to modify application data, system configurations, and SAP binaries).
- **Availability:** Total (Potential for abnormal program termination and full system compromise).
## Remediation
### Patches
- SAP has released security updates as part of the **September 2026 Patch Day**.
- Organizations should apply the latest SAP Kernel patches specifically addressing EPP processing flaws.
### Workarounds
- There are no single network controls that can fully mitigate the risk because the flaw is reachable through multiple essential protocols (SAP GUI, RFC, HTTP).
- **Temporary mitigations:** Reduce exposure of SAP management ports to the open internet and restrict access to trusted IP ranges where possible.
## Detection
- **Indicators of Compromise:** Look for abnormal program terminations (crashes) in SAP kernel processes associated with malformed EPP headers.
- **Detection methods:** Monitor SAP application layer traffic for unusual network requests containing malformed EPP data. Inventory all SAP systems to ensure visibility into the kernel versions in use.
## References
- SAP Support Portal: hxxps[://]support[.]sap[.]com/en/my-support/knowledge-base/security-notes-news/september-2026[.]html
- Onapsis Research (OVERPASS): hxxps[://]onapsis[.]com/blog/sap-overpass-remediation/
- Original News Source: hxxps[://]thehackernews[.]com/2026/09/sap-patches-cvss-100-kernel-flaw[.]html