Security Independently confirmed 2 publishers 2 min read Published Sep 12, 2026, 7:44 AM PDT Updated Oct 6, 2026, 3:22 AM PDT

Onapsis counts three network paths to the same unauthenticated SAP kernel flaw

SAP shipped Security Note 3747649 on September 8 for CVE-2026-44756, a memory corruption bug in Extended Passport processing that Onapsis says gives unauthenticated callers command execution as the account owning the SAP install.

The Watch · Security desk

Send a correction

What happened

CVE-2026-44756, named OVERPASS by Onapsis Research Labs, is a CVSS 10.0 memory corruption bug in SAP's Extended Passport processing, sitting in kernel code shared across products and protocols.
A crafted request carrying a malformed EPP header corrupts memory because SAP does not validate externally supplied length fields while it deserializes the passport data.
S/4HANA, ERP, Business Suite (ECC), NetWeaver, Web Dispatcher, BW/4HANA, Enterprise Portal, PI/PO and Solution Manager all rely on the vulnerable kernel code.
SAP published Security Note 3747649 on September 8, 2026, covering affected ABAP and Java kernels and supported Web Dispatcher versions.
The note was one of 20 new and updated security notes SAP released on its September 2026 patch day.

Why it matters

What it limits constraint Role reviews, user locks, password policy tightening and Segregation of Duties work all sit downstream of the parser, so the compensating controls an SAP team can change this week buy nothing against this bug.
Who's exposed exposure Onapsis says the vulnerable function is on by default between ABAP systems. That puts internal instances that never faced the internet in reach of any peer that can open a session to them.
Who has to decide decision Patch order is the only decision left. Firewalling the web tier leaves SAP GUI and RFC intact, so the choice is which kernels get restarted first.
What it sets up precedent One patch day carrying two pre-authentication kernel flaws sets the expectation for the next: shops that treat SAP kernel updates as a yearly project now carry both at once.

Next story · Security · 3d ago

SAP patches a maximum-severity Python SDK flaw that redirects OAuth2 token requests through tenant_subdomain

Confirmed4 publishers

Onapsis said the affected components "run under the operating system account that owns the SAP installation, so code execution under it is equivalent to owning the SAP system outright." ^[4] That account reaches the SAP secure store, database credentials, password hashes, business data and the live sessions of logged-in users, and it can rewrite configuration and SAP binaries ^[9]. Credentials stored for other SAP systems sit in the same place, so one compromised host supplies the logins for the next ^[9].

Extended Passport is a tracing structure attached to requests across the SAP ecosystem, and the kernel parses it as the session is created ^[12]^[6]. "Because EPP is processed as the session opens, every SAP control that decides who may do what, including user locks, roles, authorization objects, and logon policies, is evaluated later than the point where the flaw is reached. None of them is in the attacker's way," Onapsis said ^[5]. SOC Prime adds Segregation of Duties controls and transaction restrictions to the list of controls that never get consulted ^[6].

The flaw can be reached over at least three vectors: web requests, the SAP GUI protocol used by end users, and RFC connections between systems, according to Onapsis ^[7]^[11]. The vulnerable functionality is implemented by default between ABAP systems ^[7]. Only the patch closes it. SOC Prime says shutting one protocol can leave another path open ^[15].

A single kernel patch closes the known exploitation vectors, according to Onapsis, which recommends inventorying the full landscape and taking internet-facing systems before internal instances ^[14].

Neither Onapsis nor SAP reports evidence of exploitation in the wild ^[10]. SOC Prime tells defenders not to lean on static indicators for that reason, and to watch instead for suspicious requests hitting exposed SAP services, unexpected process execution under SAP operating system accounts, and post-exploitation access to credentials and business data ^[16].

Four of the September notes are critical ^[22]. Alongside OVERPASS, SAP fixed CVE-2026-58240, CVE-2026-76969 in multitenant applications using the Cloud Application Programming Model, and CVE-2026-66768 in NetWeaver ^[18]. Onapsis calls CVE-2026-58240 S4GET: a missing authentication check that lets remote unauthenticated attackers register unauthorized components and perform actions without authorization, resident in SAP's modern kernel, affecting every S/4HANA 2025 and earlier release ^[19]. Two of the four criticals are therefore pre-authentication flaws in kernel code ^[21]. Five further notes cover high-severity bugs in ABAP Developer Tools, Integration Suite, NetWeaver Business Client, NetWeaver and Commerce Cloud (Search And Navigation) ^[20].

What to watch

Any vendor, CERT or CISA confirmation of exploitation. Neither Onapsis nor SAP reported exploitation at disclosure.
A public proof of concept for the malformed EPP header. That would move the patch window from weeks to days.
Exploitation reports against S4GET (CVE-2026-58240), the second pre-auth kernel bug in the same patch cycle.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence72
Adoption24
Hype gap+14
Incentives68
Confidence66

Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
CVE-2026-44756, dubbed OVERPASS by Onapsis Research Labs, is a maximum-severity (CVSS 10.0) memory corruption vulnerability in SAP Extended Passport (EPP) Processing, residing in shared SAP kernel code used by multiple products and communication protocols.
Reported SupportedView cited source
[2]
The flaw stems from missing boundary validation and insufficient validation of externally supplied length fields during EPP deserialization; a specially crafted request containing a malformed EPP header causes a memory safety violation.
Reported SupportedView cited source
[3]
Successful exploitation can move beyond a crash and allow arbitrary operating system command execution under the account that owns the SAP installation, by a remote unauthenticated attacker.
Reported SupportedView cited source
[4]
"The affected components run under the operating system account that owns the SAP installation, so code execution under it is equivalent to owning the SAP system outright," Onapsis says.
Reported SupportedView cited source
[5]
"Because EPP is processed as the session opens, every SAP control that decides who may do what, including user locks, roles, authorization objects, and logon policies, is evaluated later than the point where the flaw is reached. None of them is in the attacker's way," Onapsis explains.
Reported SupportedView cited source
[6]
EPP is processed as a session is created, before standard SAP authorization checks take effect, so user locks, roles, password policies, Segregation of Duties controls and transaction restrictions do not block this exploitation path.
Reported SupportedView cited source
[7]
Onapsis says the bug can be reached via at least three vectors including web requests, the SAP GUI protocol and Remote Function Call connections, and that the vulnerable functionality is implemented by default between ABAP systems.
Reported SupportedView cited source
[8]
SAP products relying on the vulnerable kernel code include S/4HANA, ERP, Business Suite (ECC), NetWeaver, Web Dispatcher, BW/4HANA, Enterprise Portal, PI/PO and Solution Manager.
Reported SupportedView cited source
[9]
A successful attack could expose the SAP secure store, database credentials, password hashes, business information and live session data; attackers could recover stored credentials for lateral movement into other SAP systems and modify application data, system configuration or SAP binaries.
Reported SupportedView cited source
[10]
According to Onapsis there are no indicators that the vulnerability has been exploited in the wild, and SAP makes no mention of in-the-wild exploitation either.
Reported SupportedView cited source
[11]
SOC Prime says the flaw can be reached through internet-facing web requests, the SAP GUI protocol used by end users, and RFC connections between SAP systems.
Reported SupportedView cited source
[12]
Onapsis Research Labs discovered the vulnerability in SAP's processing of the Extended Passport, a tracing structure attached to requests across the SAP ecosystem.
Reported SupportedView cited source
[13]
SAP released Security Note 3747649 on September 8, 2026 to address the issue; the patch covers affected ABAP and Java kernels and supported SAP Web Dispatcher versions.
Reported SupportedView cited source
[14]
Onapsis emphasizes that a single kernel patch closes the known exploitation vectors, and the recommended remediation is to inventory the entire SAP landscape and apply the relevant kernel patch immediately, prioritizing internet-facing systems before internal instances.
Reported SupportedView cited source
[15]
No network-only workaround should be considered equivalent to patching: because the vulnerable EPP functionality is reachable across web, SAP GUI and RFC communications, blocking one protocol may leave another attack path open.
Reported SupportedView cited source
[16]
SOC Prime says defenders should not rely only on static IOCs because no confirmed in-the-wild campaign is described by the vendors, and that monitoring should focus on suspicious requests reaching exposed SAP services, abnormal application-server behavior, unexpected process execution under SAP operating system accounts, and post-exploitation access to credentials or sensitive business data.
Reported SupportedView cited source
[17]
SAP released 20 new and updated security notes on Tuesday, its September 2026 security patch day.
Reported SupportedView cited source
[18]
Three other critical flaws were resolved with SAP's fresh patches: CVE-2026-58240 (missing authentication check in NetWeaver), CVE-2026-76969 (credential disclosure in multitenant applications using the Cloud Application Programming Model) and CVE-2026-66768 (improper access control in NetWeaver).
Reported SupportedView cited source
[19]
The missing authentication issue, dubbed S4GET, could allow remote unauthenticated attackers to register unauthorized components and perform actions without authorization; it resides in SAP's modern kernel and every S/4HANA 2025 and earlier release is affected, Onapsis says.
Reported SupportedView cited source
[20]
Five of the security notes released on SAP's September 2026 security patch day address high-severity flaws in ABAP Developer Tools, Integration Suite, NetWeaver Business Client, NetWeaver and Commerce Cloud (Search And Navigation).
Reported SupportedView cited source
[21]
Two of the four critical notes are flaws in SAP kernel code exploitable without authentication: CVE-2026-44756 in shared kernel EPP processing and CVE-2026-58240 in SAP's modern kernel.
Derived Supported
[22]
SAP's September 2026 patch day carried four critical security notes: CVE-2026-44756 plus the three others.
Derived Supported

Sources

2 independent publishers whose own reporting we read for this story.

securityweek.com
1 article · September 12, 2026
SAP Patches Critical Extended Passport Processing Vulnerability - SecurityWeek
socprime.com
1 article · September 12, 2026
CVE-2026-44756 SAP Kernel RCE Vulnerability

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

Builder

SecurityWeek carries the line a developer needs: the vulnerable Extended Passport handling "is implemented by default between ABAP systems." Internal system-to-system RFC links are therefore part of the exposed surface, not only the web endpoints someone remembered to firewall. Neither publisher says anything about custom code that builds or forwards passports, and neither lists the kernel versions; SAP's own note carries those.

Operator

SOC Prime supplies the working order: inventory the landscape, apply the kernel patch, take internet-facing systems before internal ones, and do not treat protocol blocking as equivalent to the fix. SecurityWeek supplies the scope: 20 notes, four of them critical, two of the four in kernel code reachable without a login. Both say Onapsis has seen no exploitation, so the pressure here is the size of the affected estate, and SOC Prime's interim advice is behavioural monitoring of SAP-facing services and process execution under SAP operating system accounts.

Investor

There is no financial content in this reporting. Nobody counts exposed customers, estimates unpatched systems, or puts a number on the operational cost of a kernel update across an SAP landscape. The one commercial fact a reader should hold is that both accounts rest on research from Onapsis, which sells SAP application security, and that the SOC Prime piece doubles as a placement for its own detection content.