Critical Kernel Flaw Enables Unauthenticated Remote Code Execution

SAP has patched a maximum-severity vulnerability in its kernel that enables unauthenticated remote code execution with administrative privileges. Tracked as CVE-2026-44756 and codenamed OVERPASS, the flaw carries a CVSS score of 10.0 and affects multiple SAP communication layers simultaneously.

What Happened: SAP OVERPASS Kernel Flaw Grants Total System Compromise

On September 9, 2026, SAP released security updates for multiple vulnerabilities discovered during its September Patch Day. The most severe is CVE-2026-44756, a memory-corruption flaw in the SAP kernel’s Extended Passport (EPP) processing. Security firm Onapsis discovered and reported the bug, assigning it the name OVERPASS.

The vulnerability exists in shared kernel code that processes EPP data. Consequently, the same defect is reachable through several SAP components and protocols. None of these paths require credentials. This means an attacker can exploit the flaw remotely and without authentication to run arbitrary operating system commands on the SAP host with SAP administrative privileges.

CISA has not yet added CVE-2026-44756 to its Known Exploited Vulnerabilities catalog. However, the flaw’s severity and broad attack surface make rapid patching essential. Also, Onapsis has confirmed at least three separate exploitation paths. Therefore, no single network control can fully mitigate risk.

Technical Details of the OVERPASS Vulnerability

OVERPASS stems from missing boundary validation during the deserialization of Extended Passport data. EPP is a standard SAP tracing structure that clients attach to requests. It is created when a new user session opens and is transported by communication protocols such as HTTP, SAP GUI, and RFC.

An unauthenticated attacker can send a crafted network request containing a malformed EPP header. The malformed header triggers a memory safety violation when the kernel processes externally supplied length fields. Successful exploitation hands the attacker control of the receiving process. From there, the attacker can execute operating system commands on the host.

Three Confirmed Attack Vectors

• Web layer (HTTP/HTTPS): The SAP Internet Communication Manager and SAP Web Dispatcher process an Extended Passport supplied with a web request. This tier powers SAP Fiori, SAP WebGUI, web services, and API-based integrations. Organizations commonly expose this layer to the Internet.
• SAP GUI layer: The SAP Dispatcher accepts user connections and processes an Extended Passport supplied over the SAP GUI protocol. Every classic SAP GUI logon goes through this component.
• RFC layer: SAP systems exchange an Extended Passport while establishing a Remote Function Call connection. RFC is the mechanism SAP systems use to talk to one another and underpins many third-party and custom integrations.

These are not different vulnerabilities. There are several routes to the same defect. SAP addresses all of them with a single kernel patch. Restricting one protocol narrows exposure, but only the patch closes every path.

What Code Execution Actually Means

The affected components run under the operating-system account that owns the SAP installation. Consequently, code execution under this account is equivalent to owning the SAP system outright. An attacker can read the SAP secure store to recover database credentials, password hashes, and all housed business data. Also, the attacker can read the live session data of logged-in users and extract stored credentials to move laterally into every other SAP system. Furthermore, the attacker can modify application data, system configuration, and SAP binaries.

Importantly, SAP authorizations and Segregation of Duties controls do not help. The vulnerable code runs before any authentication step. Therefore, locking users, tightening roles, enforcing password policies, or restricting transaction access has no effect on this attack path.

Business and Operational Impact

The impact of OVERPASS is severe for any organization running affected SAP systems. The vulnerability touches the core of enterprise resource planning infrastructure. Consequences include:

• Total data compromise: Attackers can access all business data housed in the SAP system, including financial records, customer data, and supply-chain information.
• Lateral movement: Extracted credentials enable pivoting into every other SAP system in the landscape.
• Session hijacking: Live session data of logged-in users can be read in real time.
• System integrity loss: Attackers can modify application data, system configuration, and SAP binaries, making forensic recovery difficult.
• Compliance implications: Unauthorized access to sensitive business data may trigger regulatory reporting obligations under GDPR, SOX, and other frameworks.

Because EPP processing is shared kernel code used by more than one protocol, the flaw exists by default in a wide range of SAP technology components. This means exposure is not limited to a single product line or deployment model.

Mitigation and Recommendations

Onapsis and SAP strongly recommend treating patching as an emergency priority. A single kernel patch closes all exploitation vectors. Organizations should apply SAP Security Note 3747649 immediately.

Immediate Actions for Defenders

1. Inventory every SAP system and identify which are running affected kernel versions.
2. Patch internet-facing systems first, then move to internal instances.
3. Reduce exposure where possible by restricting unnecessary external access to SAP services.
4. Monitor for exploitation attempts while the rollout is in progress. Ensure visibility into the SAP application layer.
5. Verify patch application by checking kernel versions against SAP Security Note 3747649.

Detection Guidance

Until patches are applied, organizations should monitor the SAP application layer for anomalous activity. Indicators to watch for include unexpected EPP-related errors, unusual process behavior in the SAP kernel, and unauthorized access attempts against SAP services. Also, review logs for signs of unauthorized command execution on SAP hosts.

Bottom line: CVE-2026-44756 is a CVSS 10.0 unauthenticated remote code execution flaw in SAP kernel code. It is reachable through multiple protocols, requires no credentials, and grants total system compromise. Patch now.

Incident Summary

CVE ID / Incident:	CVE-2026-44756 (OVERPASS)
Affected Systems:	SAP systems using affected kernel versions; reachable via HTTP/HTTPS, SAP GUI, and RFC
Disclosure Date:	September 9, 2026
Patch Status:	Available — SAP Security Note 3747649
CVSS Score:	10.0 (Critical)
Attack Vector:	Network, unauthenticated
CISA KEV Status:	Not yet added

References

1. The Hacker News, “SAP Patches CVSS 10.0 Kernel Flaw Enabling Unauthenticated Remote Code Execution,” September 9, 2026, https://thehackernews.com/2026/09/sap-patches-cvss-100-kernel-flaw.html, accessed September 9, 2026.
2. Onapsis, “Mitigating OVERPASS (CVE-2026-44756): A Critical Vulnerability in the SAP Kernel,” September 9, 2026, https://onapsis.com/blog/sap-overpass-remediation/, accessed September 9, 2026.
3. Onapsis, “SAP Security Patch Day September 2026,” September 9, 2026, https://onapsis.com/blog/sap-security-patch-day-september-2026/, accessed September 9, 2026.
4. SAP, “September 2026 SAP Security Notes,” SAP Support Portal, September 9, 2026, https://support.sap.com/en/my-support/knowledge-base/security-notes-news/september-2026.html, accessed September 9, 2026.
5. CISA, “Known Exploited Vulnerabilities Catalog,” https://www.cisa.gov/known-exploited-vulnerabilities-catalog, accessed September 9, 2026.