CVE-2026-44756

CVE Enrichment

CVSS: 10.0 CRITICAL
EPSS: 0.68%
EPSS Percentile: 51.07%
CISA KEV: Not listed

Description

A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditions, an unauthenticated attacker could exploit a crafted network request containing a malformed EPP header, potentially resulting in undefined behavior and abnormal program termination. Successful exploitation may have a high impact on the confidentiality, integrity, and availability of the application.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: cna@sap.com
Published: 08-Sep-2026 08:17
Last Modified: 23-Sep-2026 04:17
EPSS Date: 2026-10-13
CWE: CWE-120

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:N /
                            UI:N /
                            S:C /
                            C:H /
                            I:H /
                            A:H

References

Last enrichment sync: 13-Oct-2026 23:21
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (2)

More recently, in September, it also fixed the CVE-2026-44756 memory corruption flaw in the SAP Kernel code, dubbed OVERPASS by Onapsis security researchers who reported it. SAP Patches Maximum-Severity OAuth2 SSRF Flaw in Python SDK
The announcement followed SAP's September 8 release of fixes for CVE-2026-44756, also known as OVERPASS, a critical memory corruption vulnerability in SAP Extended Passport (EPP) processing. Critical SAP Extended Passport flaw can enable system compromise; patches available

CVE (4)

People (2)

MITRE ATT&CK (3)

Vendors (1)

Products (8)

Tools (1)

Industries (6)

Countries (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.