Back to threat alerts

SAP OVERPASS (CVE-2026-44756): A Critical Vulnerability in the SAP Kernel

"OVERPASS" is a maximum-severity (CVSS 10.0) memory corruption vulnerability located within the SAP Extended Passport (EPP) processing library. Because EPP is a shared core component used for system tracing, this flaw impacts a massive array of SAP systems. It allows unauthenticated remote attackers to completely bypass standard identity defenses and gain full administrative control over the underlying operating system and SAP business applications.

Threat alert
September 9, 2026

The profound severity of the OVERPASS vulnerability stems from its location within the shared SAP kernel code, rendering it ubiquitous across a vast array of SAP technology components, including the Internet Communication Manager (ICM), SAP Web Dispatcher, and the SAP GUI Dispatcher. Because the vulnerability is triggered during the initialisation of a connection standard identity-based defenses are entirely bypassed.
‍

According to SAP documentation, the Extended Passport is a standardised tracing structure utilised to analyse call sequences and correlate log traces across distributed, multi-tier system landscapes. When a client initiates a request to an SAP system, it generates and attaches the EPP structure, often visible as the SAP-PASSPORT HTTP header or a comparable payload in other protocols. This tracing mechanism allows system administrators and performance monitoring tools to track the execution flow of a specific transaction across highly complex, integrated SAP and non-SAP components, facilitating end-to-end troubleshooting.

‍
Vulnerability Mechanics: Memory Corruption and Buffer Overflow

CVE-2026-44756 is fundamentally a memory safety vulnerability is characterised as a buffer overflow or memory corruption flaw located within the shared C/C++ kernel code responsible for processing the incoming EPP structure. When an SAP application server or Web Dispatcher receives an inbound connection, it automatically extracts the SAP-PASSPORT payload to initialise its internal tracing mechanisms.

Under specific conditions, an unauthenticated threat actor can intentionally transmit a specially crafted network request containing a malformed EPP header.

The Attack Chain
  • Zero-Click, Pre-Authentication: The Extended Passport (EPP) structure is processed at the exact moment a new network connection is initialized. Because this happens before any passwords, role-based access controls, or user locks are evaluated, the attacker does not need valid credentials.

  • Exploitation: An attacker intentionally transmits a specially crafted, malformed EPP network request to the target SAP system. This payload can be delivered over standard web channels (HTTP/HTTPS), the internal SAP GUI protocol, or system-to-system Remote Function Call (RFC) connections.

  • System Takeover: The vulnerable SAP system fails to properly validate the malicious input, causing a memory buffer overflow. The attacker can then hijack the system's execution flow to run arbitrary operating system commands with full SAP administrative privileges, allowing them to steal data, harvest passwords, and alter financial records. 


Vulnerable Components and Versions

Specifically, the vulnerable components and their affected versions include:

  • KRNL64NUC: 7.22 and 7.22EXT
  • KRNL64UC: 7.22, 7.22EXT, 7.53, and 8.04
  • WEBDISP (Web Dispatcher): 9.16, 9.18, 9.19, and 9.20 ‍
  • KERNEL: 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.16, 9.18, 9.19, and 9.20
Mitigations & Recommendations

Because the flaw is reachable through several protocols and requires no credentials, network controls alone cannot fully mitigate the risk. Organizations must take the following prioritized actions:

  • Apply Emergency Patches: The only complete resolution is to immediately apply the vendor-supplied fixes detailed in SAP Security Note 3747649. 


  • Prioritize the Perimeter: Assess the environment and patch all internet-facing systems (such as SAP Web Dispatchers and the Internet Communication Manager) first, as these are exposed to external, unauthenticated attackers.
  • Secure Internal Systems: Internal application servers must be patched immediately afterward. Internal systems are not safe; the vulnerability can be exploited internally over the SAP GUI or RFC layers to rapidly move laterally across the network. ‍
  • Monitor for Threat Activity: Proactively monitor SAP environments for exploitation attempts, unauthorised access to the SAP secure store, or unusual administrative commands executed on the host operating system.

Advisory notice: https://me.sap.com/notes/3756304