Critical SAP Extended Passport flaw can enable system compromise; patches available
Summary
CVE-2026-44756 is a critical SAP Extended Passport memory-corruption flaw reachable through HTTP(S), SAP GUI, and RFC. SAP released fixes; researchers report exploitation can enable OS command execution on affected hosts.
Key points
- CVE-2026-44756, also known as OVERPASS, affects SAP Extended Passport processing and has a CVSS score of 10.0.
- Affected products include SAP S/4HANA, ECC, NetWeaver, Web Dispatcher, Enterprise Portal, BW/4HANA, PI/PO, and Solution Manager.
- The flaw can be reached through HTTP(S), SAP GUI, or RFC connections; exploitation requires network access to a vulnerable service.
- Researchers demonstrated exploitation that could compromise the affected SAP process; Onapsis reports it can lead to operating-system command execution on the host.
- SAP released fixes on September 8 in Security Note 3747649. Organizations should identify affected kernel and Web Dispatcher versions and apply the updates.
- While patching, restrict access to SAP GUI, RFC, and administrative interfaces, prioritize internet-facing systems, and monitor for crashes, unusual commands, and abnormal RFC activity.
Article Details
- Vulnerability Types
- Memory corruption
- Stack-based buffer overflow in Extended Passport deserialization
- Severity
- Critical (CVSS 10.0)
- Exploitation Status
- reported
- Exploit Availability
- public_poc
- Patch Status
- available
- Workarounds
- Apply the HTTP-focused mitigations documented in SAP Security Note 3747649 while completing the kernel upgrade.
MITRE ATT&CK
T1021.003 · Distributed Component Object ModelThe article describes trusted RFC connections as a possible path from a compromised SAP host to connected SAP systems.T1059 · Command and Scripting InterpreterOnapsis Research Labs reports that exploitation can enable operating-system command execution on the SAP host.T1203 · Exploitation for Client ExecutionA specially crafted request exploits the buffer overflow in SAP Extended Passport processing to compromise the affected SAP process.
CVE
Vendors
Products
SAP Extended PassportThe announcement followed SAP's September 8 release of fixes for CVE-2026-44756, also known as OVERPASS, a critical memory corruption vulnerability in SAP Extended Passport (EPP) processing.SAP Web DispatcherOrganizations with internet-facing SAP web applications, portals, APIs, and SAP Web Dispatcher deployments are likely to face the greatest exposure because the vulnerable functionality can be reached directly through
Tools
Industries
financeSAP systems are attractive targets because they often sit at the center of critical business operations, including finance, payroll, procurement, manufacturing, and supply chain management.ManufacturingSAP systems are attractive targets because they often sit at the center of critical business operations, including finance, payroll, procurement, manufacturing, and supply chain management.PayrollSAP systems are attractive targets because they often sit at the center of critical business operations, including finance, payroll, procurement, manufacturing, and supply chain management.ProcurementSAP systems are attractive targets because they often sit at the center of critical business operations, including finance, payroll, procurement, manufacturing, and supply chain management.Supply chainSAP systems are attractive targets because they often sit at the center of critical business operations, including finance, payroll, procurement, manufacturing, and supply chain management.