SAP Fixes CVSS 10.0 OVERPASS Flaw Allowing Unauthenticated Remote Code Execution

SAP has released its September 2026 security updates, addressing multiple vulnerabilities across its enterprise software portfolio, including a maximum-severity flaw in the SAP Kernel that could allow unauthenticated attackers to remotely execute operating-system commands.

Tracked as CVE-2026-44756 and dubbed OVERPASS by security researchers at Onapsis, the vulnerability carries a CVSS score of 10.0, the highest possible severity rating.

The flaw is located in the processing of Extended Passport (EPP) data within the SAP Kernel. A missing boundary validation during the deserialization of externally supplied data can result in memory corruption and potentially allow a remote attacker to gain control of the affected SAP process.

The vulnerability is particularly concerning because exploitation reportedly requires no authentication and no user interaction. Depending on the affected deployment and exposed communication path, successful exploitation could allow attackers to execute arbitrary commands with the privileges of the SAP process.

SAP's September Security Patch Day included 19 new security notes and one update to a previously released note, with CVE-2026-44756 among the most serious issues addressed.

Key Takeaways

• CVE-2026-44756, dubbed OVERPASS, has a CVSS score of 10.0.
• The vulnerability affects SAP Kernel processing of Extended Passport (EPP) data.
• Exploitation can be performed remotely without authentication.
• Successful exploitation can lead to arbitrary operating-system command execution.
• The vulnerability originates from insufficient boundary validation during EPP deserialization.
• The affected code is shared across multiple SAP communication paths.
• Potential impact includes theft of credentials, business data and session information, as well as modification of SAP configurations and binaries.
• SAP has released security updates covering affected kernel versions.
• No confirmed exploitation of OVERPASS in the wild has been reported at the time of publication.
• SAP customers should prioritize patching internet-facing and business-critical SAP systems.

What Is the OVERPASS Vulnerability?

CVE-2026-44756 is a memory-corruption vulnerability in SAP's handling of Extended Passport Processing.

Extended Passport is a tracing structure that can accompany requests processed by SAP systems. According to Onapsis, the vulnerable code is shared across multiple protocols and communication paths, making the flaw potentially reachable through several SAP components.

The vulnerability results from a missing boundary validation when externally supplied length information is processed during deserialization.

An attacker can potentially construct malicious EPP data containing manipulated length fields and send it to an affected SAP system.

If successfully processed, the malformed data can trigger memory-safety violations and potentially allow control over the affected process.

Why CVSS 10.0 Matters

A CVSS score of 10.0 indicates the vulnerability represents the highest possible level of technical severity.

The risk is amplified by several characteristics of OVERPASS:

Attack Characteristic	Status
Remote exploitation	Yes
Authentication required	No
User interaction	Not required
Attack complexity	Reported as low
Potential RCE	Yes
Privilege impact	High
Confidentiality impact	High
Integrity impact	High
Availability impact	High
CVSS	10.0 Critical

The combination of remote reachability, lack of authentication and potential operating-system command execution makes this significantly more serious than a vulnerability that requires an already compromised or authenticated SAP account.

Multiple SAP Communication Paths Increase Exposure

One of the most important aspects of OVERPASS is that the vulnerable kernel functionality is not limited to a single isolated application interface.

Onapsis researchers said the EPP processing code is shared by multiple protocols and can be reached through different SAP communication layers.

Potential attack paths include:

• Internet-facing web interfaces
• SAP GUI communication
• RFC connections between SAP systems
• SAP application server components
• SAP Web Dispatcher environments

This means organizations cannot necessarily eliminate the risk simply by blocking one specific network port or protocol.

Security teams should therefore map all exposed SAP communication paths rather than assuming that only externally accessible web servers require immediate attention.

Potential Impact of Successful Exploitation

A successful OVERPASS attack could have consequences far beyond a single compromised process.

According to Onapsis, attackers could potentially use access obtained through the vulnerability to:

Steal Database Credentials

Attackers could attempt to access the SAP secure store and recover credentials used to connect to backend databases.

Access Password Hashes

Sensitive authentication material stored on compromised systems could potentially become accessible.

Access Business Data

SAP systems frequently contain highly sensitive enterprise information, including:

• Financial records
• Customer information
• Employee data
• Supply-chain information
• Business transactions
• Internal documents

Hijack User Sessions

Attackers may potentially access information associated with active SAP sessions.

Move Laterally

Credentials extracted from a compromised SAP environment could potentially be used to access additional SAP systems.

Modify Business Data

Attackers with sufficient access could alter application information and potentially disrupt business processes.

Modify SAP Configuration

System configuration changes could be used to establish persistence or weaken security controls.

Tamper With SAP Binaries

A compromised SAP host could potentially be modified at the software level, increasing the difficulty of detecting and removing an attacker.

SAP Products and Kernel Versions

SAP's September 2026 security advisory lists CVE-2026-44756 across multiple SAP Kernel and Web Dispatcher versions.

Affected versions listed by SAP include:

• KRNL64NUC 7.22 / 7.22EXT
• KRNL64UC 7.22 / 7.22EXT
• KRNL64NUC 7.53
• KERNEL 7.22
• KERNEL 7.53
• KERNEL 7.54
• KERNEL 7.77
• KERNEL 7.89
• KERNEL 7.93
• KERNEL 8.04
• KERNEL 9.16
• KERNEL 9.18
• KERNEL 9.19
• KERNEL 9.20
• Web Dispatcher 9.16–9.20

Organizations should consult the relevant SAP Security Note 3747649 and their SAP Support Portal for the exact patch level applicable to their environment.

Other Critical SAP Vulnerabilities Patched

OVERPASS was not the only critical vulnerability addressed during SAP's September security update cycle.

CVE-2026-58240 — CVSS 9.8

A missing authentication check in SAP NetWeaver Message Server could allow unauthenticated attackers with network access to perform unauthorized actions.

Onapsis has dubbed the vulnerability S4GET.

The issue affects SAP Kernel 9.x lines and is particularly concerning because the vulnerable functionality is exposed through a communication path used by SAP GUI clients.

CVE-2026-76969 — CVSS 9.4

A credential-disclosure vulnerability affects multitenant applications using the SAP Cloud Application Programming Model (CAP).

A specially crafted request could allow an unauthenticated attacker to obtain sensitive credentials and potentially use them to modify or delete tenant data.

CVE-2026-66768 — CVSS 9.0

An improper access-control vulnerability in SAP NetWeaver SAP GUI for Java could allow attackers to execute arbitrary commands on the underlying host.

Together, these vulnerabilities create a particularly significant patching workload for organizations operating large SAP environments.

No Confirmed Active Exploitation

At the time of publication, there are no confirmed reports that CVE-2026-44756 has been exploited in the wild.

However, the severity and attack characteristics make rapid remediation important.

A maximum-severity vulnerability that can be reached remotely without authentication can become highly attractive to threat actors once technical details become widely available.

Organizations should therefore avoid waiting for evidence of active exploitation before beginning remediation.

Recommended Actions for SAP Security Teams

1. Prioritize CVE-2026-44756

Review SAP Security Note 3747649 and identify every affected SAP Kernel installation.

Patch systems according to SAP's recommended versions and dependencies.

SAP itself recommends customers prioritize the September security updates.

2. Patch Internet-Facing Systems First

Organizations with large SAP landscapes should prioritize:

1. Internet-facing systems
2. Externally accessible application servers
3. SAP Web Dispatcher infrastructure
4. Systems handling sensitive business data
5. Critical production systems
6. Internal SAP systems

Onapsis specifically recommends inventorying the SAP environment and addressing internet-facing systems before internal instances.

3. Identify All Exposed SAP Interfaces

Security teams should map:

• HTTP/HTTPS
• SAP GUI
• RFC
• Web Dispatcher
• Application Server interfaces
• Inter-system SAP communications

The goal is to identify where vulnerable EPP processing may be reachable.

4. Do Not Rely on SAP Authorizations Alone

Traditional SAP authorization controls may not prevent exploitation of a vulnerability that occurs before authentication.

This means organizations should not assume that restrictive SAP roles, password policies or Segregation of Duties controls alone eliminate the risk.

Onapsis specifically warns that SAP authorization and SoD controls do not mitigate this particular pre-authentication attack path.

5. Monitor for Exploitation Attempts

Security teams should monitor SAP application and network telemetry for:

• Malformed requests
• Unexpected EPP-related traffic
• Abnormal SAP process termination
• Unexpected child processes
• OS command execution from SAP processes
• Suspicious outbound connections
• Unusual authentication activity
• Unexpected modifications to SAP configuration

SOC Detection Opportunities

For organizations operating a SIEM or SOC, detection should focus on the behavioral consequences of exploitation.

Potential detection scenarios include:

SAP Process Spawning a Shell

Alert when SAP-related processes unexpectedly launch:

cmd.exe
powershell.exe
/bin/sh
/bin/bash

Unexpected OS-Level Commands

Investigate operating-system commands initiated by SAP application processes that are inconsistent with normal administrative operations.

Suspicious Network Activity

Monitor SAP application servers for unexpected outbound connections to unfamiliar external infrastructure.

Abnormal SAP Process Crashes

Repeated or unusual crashes involving SAP kernel processes should be correlated with suspicious network requests.

Sensitive File Access

Investigate unexpected access to:

• SAP secure stores
• Configuration files
• Credential stores
• SAP binaries
• Database connection information

Lateral Movement

Monitor for SAP servers initiating unusual authentication or network activity toward other SAP systems.

Why OVERPASS Deserves Immediate Attention

SAP environments are frequently embedded deeply into enterprise operations.

They can support:

• Financial management
• Human resources
• Supply-chain operations
• Manufacturing
• Procurement
• Customer management
• Enterprise resource planning

Compromise of a central SAP environment can therefore have consequences extending well beyond traditional IT infrastructure.

OVERPASS is particularly concerning because the attack begins at the kernel level, before normal application-layer security controls can necessarily intervene.

A successful attacker could potentially transition from a network-accessible SAP service to operating-system-level control and then use that position to target sensitive enterprise processes.

Patch Prioritization

Organizations should consider the following priority model:

Priority	Action
P1 – Immediate	Patch CVE-2026-44756 on internet-facing SAP systems
P1 – Immediate	Patch CVE-2026-58240 on exposed NetWeaver Message Servers
P1 – Immediate	Review other critical September SAP security notes
P2 – High	Identify vulnerable internal SAP systems
P2 – High	Hunt for exploitation indicators
P2 – High	Review SAP-to-SAP communication paths
P3 – Planned	Complete remaining SAP security updates
Continuous	Maintain SAP asset and kernel-version inventory

Bottom Line

CVE-2026-44756 (OVERPASS) is one of the most serious SAP vulnerabilities disclosed in 2026.

Its CVSS 10.0 rating, unauthenticated remote attack path and potential for operating-system command execution make it a critical priority for organizations running affected SAP Kernel versions.

The absence of confirmed exploitation provides defenders with an opportunity to patch before attackers can operationalize the vulnerability.

For SAP administrators and security teams, the priority should be clear:

Identify affected systems, patch exposed SAP infrastructure first, monitor for exploitation attempts and investigate any unexpected operating-system activity originating from SAP processes.

With SAP systems often sitting at the center of critical business operations, treating OVERPASS as a routine patching task could leave organizations exposed to a potentially devastating enterprise compromise.

Vulnerability Quick Reference

Attribute	Details
CVE	CVE-2026-44756
Nickname	OVERPASS
CVSS	10.0 / Critical
Component	SAP Kernel / Extended Passport Processing
Vulnerability Type	Memory Corruption
Attack Vector	Network
Authentication	Not required
User Interaction	Not required
Potential Impact	Remote Code Execution
Potential Privileges	SAP administrative / OS-level impact
Exploitation Status	No confirmed in-the-wild exploitation
SAP Security Note	3747649
Disclosure	September 2026 SAP Security Patch Day
Researcher	Onapsis Research Labs