- The Mess: A memory-corruption bug in SAP’s shared kernel code lets unauthenticated attackers reach operating-system command execution. Onapsis calls it OVERPASS — CVE-2026-44756.
- The Damage: One crafted request can potentially turn an exposed SAP host into a fully compromised business system.
- The Fix: Apply SAP Security Note 3747649 immediately and patch the affected SAP kernel across every exposed system.
This one is ugly.
CVE-2026-44756 carries a CVSS score of 10.0, the maximum possible rating. It affects SAP Extended Passport (EPP) processing, a kernel-level mechanism used when SAP systems establish communication. SAP classified it as Critical in its September 2026 security release.
Onapsis named the vulnerability OVERPASS.
The important word isn’t the name.
It’s unauthenticated.
The bug lives underneath the application
Extended Passport is part of SAP’s tracing and request-processing machinery. The vulnerable code sits in the SAP kernel rather than some isolated business application.
The flaw comes from insufficient boundary validation while deserializing EPP data. An attacker can supply malformed length information and trigger unsafe memory handling.
That sounds like a classic memory-corruption bug.
The consequences are much worse.
Onapsis says a specially crafted request can take control of the receiving process and allow arbitrary operating-system commands to execute with SAP administrative privileges. That can result in compromise of the underlying SAP data and business processes.
Three doors. One kernel bug.
OVERPASS is particularly nasty because EPP processing is shared by several SAP communication paths.
Onapsis confirmed at least three attack vectors:
- Web: SAP Internet Communication Manager and SAP Web Dispatcher process EPP data supplied through HTTP/HTTPS traffic.
- SAP GUI: the SAP Dispatcher processes EPP data during user connections.
- RFC: SAP systems exchange EPP information when establishing Remote Function Call connections.
So there isn’t one magic firewall rule that solves this.
Closing the web interface doesn’t necessarily eliminate the vulnerable code.
Neither does blocking SAP GUI traffic.
Neither does restricting RFC.
The same kernel flaw sits underneath multiple protocols.
Authentication comes too late
This is the part defenders should pay attention to.
The vulnerability is reached while the session is being established.
That means normal SAP authorization controls don’t get a chance to save you first.
User roles, authorization objects, account restrictions and other controls operate later in the process. OVERPASS reaches vulnerable kernel code before those mechanisms can meaningfully protect the request.
No password.
No SAP account.
No user interaction.
Just a network request reaching vulnerable kernel code.
The blast radius is bigger than the web server
SAP’s September security bulletin lists a long range of affected kernel and Web Dispatcher versions, including 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.16, 9.18, 9.19 and 9.20 variants.
That matters because the vulnerable component isn’t necessarily something an administrator thinks of as an Internet-facing application.
It can sit behind:
- SAP Fiori
- SAP WebGUI
- SAP GUI
- API integrations
- RFC connections
- SAP Web Dispatcher
The same vulnerable kernel code can therefore be reached through infrastructure that performs completely different jobs.
Public exploit is the next concern
Onapsis said it had not observed active exploitation in the wild when it published its advisory.
It also deliberately withheld technical exploitation details that could make weaponization easier.
That is the good news.
The bad news is the patch is now public.
And defenders know exactly where to look.
The Stack reported that Onapsis expects patch-diff analysis to potentially lead to a public proof of concept, while noting that more than 10,000 SAP instances may be publicly exposed.
For a CVSS 10 pre-auth kernel flaw, that is not a comfortable countdown.
Bugstoday Opinion
OVERPASS is what happens when the vulnerable code isn’t sitting in some forgotten plugin.
It’s sitting in the SAP kernel.
One bug.
Multiple protocols.
No credentials.
And potentially complete control of the SAP host.
The most dangerous part isn’t the CVSS 10.0 badge.
It’s the fact that organizations can have several apparently separate SAP entry points while all of them eventually hit the same vulnerable kernel code.
Patch the kernel. Then assume someone will eventually reverse-engineer the patch.
Today’s Bugs. Tomorrow’s Breaches.
Technical Sources
- SAP Security Patch Day — September 2026, Security Note 3747649
- Onapsis Research Labs — OVERPASS / CVE-2026-44756
- CVE-2026-44756 — SAP Extended Passport Processing
