{"id":2899,"date":"2026-09-10T01:30:41","date_gmt":"2026-09-10T08:30:41","guid":{"rendered":"https:\/\/www.cycognito.com\/blog\/?p=2899"},"modified":"2026-09-10T01:30:43","modified_gmt":"2026-09-10T08:30:43","slug":"emerging-threat-cve-2026-44756-sap-remote-code-execution-via-extended-passport-processing","status":"publish","type":"post","link":"https:\/\/www.cycognito.com\/blog\/emerging-threat-cve-2026-44756-sap-remote-code-execution-via-extended-passport-processing\/","title":{"rendered":"Emerging Threat: (CVE-2026-44756) SAP Remote Code Execution via Extended Passport Processing"},"content":{"rendered":"\n
\"\"
Sample of assets impacted by SAP RCE vulnerability, identified by the CyCognito Platform<\/em>
<\/figcaption><\/figure>\n\n\n\n

What is CVE-2026-44756?<\/h2>\n\n\n\n

CVE-2026-44756, tracked by SAP under the name OVERPASS, is a memory corruption vulnerability in the SAP kernel code that processes the Extended Passport (EPP), a standard SAP tracing structure used to follow call sequences across distributed system landscapes. The flaw stems from missing boundary validation during deserialization of EPP data, which causes unsafe memory behavior when the kernel processes externally supplied length fields.<\/p>\n\n\n\n

The vulnerability carries a CVSS v3.1 base score of 10.0 (Critical).<\/p>\n\n\n\n

Exploitation is pre-authentication. EPP data is parsed as the session opens, before the session is authenticated, which means SAP user authorizations and segregation of duties controls are evaluated only after the vulnerable code path has already been reached. An unauthenticated attacker with network access to a listening SAP service is sufficient.<\/p>\n\n\n\n

Successful exploitation results in arbitrary operating system command execution under the account that owns the SAP system. From that position an attacker can recover database credentials and password hashes, read active user sessions, alter system configuration, and modify SAP binaries. Because the affected code sits in the kernel rather than in a single application module, the flaw is reachable over three separate protocol paths: HTTP and HTTPS through the Internet Communication Manager and SAP Web Dispatcher, classic SAP GUI connections through the SAP Dispatcher, and system-to-system Remote Function Call connections. No single network control closes all three.<\/p>\n\n\n\n

What assets are affected by CVE-2026-44756?<\/h2>\n\n\n\n

The vulnerability lives in shared SAP kernel code, so the affected footprint spans product lines rather than a single application. SAP S\/4HANA, SAP ERP and Business Suite (ECC), SAP NetWeaver Application Server ABAP, SAP Web Dispatcher, SAP BW\/4HANA, SAP Enterprise Portal, SAP PI\/PO, and SAP Solution Manager all draw on the affected component.<\/p>\n\n\n\n

SAP lists affected kernel components as KRNL64NUC 7.22 and 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, and 8.04, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.16, 9.18, 9.19, and 9.20, and WEBDISP 9.16, 9.18, 9.19, and 9.20. EPP processing is present in default configurations, so no unusual tracing setup is required for a system to be affected.<\/p>\n\n\n\n

In practice, an affected internet-facing asset most often looks like a Web Dispatcher or Internet Communication Manager endpoint fronting Fiori, WebGUI, or API traffic. These are deliberately published services, which is precisely why they accumulate outside the boundary of routine internal patch cycles.
<\/p>\n\n\n\n

Reverse proxies, partner integration endpoints, and regional or subsidiary SAP landscapes are common places for an instance to sit reachable and unaccounted for, and SAP kernel patching is frequently coupled to business change windows that run on quarterly rather than monthly cadences.<\/p>\n\n\n\n

What does our data show about exposure patterns?<\/h2>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Exposure in this set is led by Information Technology at 33.2% of observed assets, with Communication Services contributing 31.8%. Consumer Staples follows at 12.6%. These assets were predominantly identified by service fingerprint rather than by confirmed version detection, so they are best read as assets observed running the affected software and potentially exposed rather than as confirmed vulnerable instances.<\/p>\n\n\n\n

The concentration in Information Technology and Communication Services is consistent with how those sectors operate SAP. Both run large, long-lived landscapes that serve many downstream consumers, including managed service and outsourcing arrangements where a single provider hosts SAP estates on behalf of multiple client organizations. <\/p>\n\n\n\n

That model multiplies the number of published endpoints per SAP landscape, and it distributes patch authority across contractual boundaries, where a kernel update depends on agreement between the asset owner and the party operating it. Media and entertainment groups add a second pattern: acquisition-heavy structures that leave regional SAP instances running under separate operational ownership long after the corporate consolidation is complete.<\/p>\n\n\n\n

Across the full set, the recurring driver is not neglect of a known vulnerable version but incomplete visibility into which SAP endpoints are published and who is responsible for them. EPP processing is not a feature most operators would think to inventory, and it is reachable on services that were deliberately exposed for legitimate business reasons. <\/p>\n\n\n\n

The result is a vulnerability that lands squarely on infrastructure organizations already believe they understand, which is the harder problem to remediate on a short timeline.<\/p>\n\n\n\n

Are fixes available?<\/h2>\n\n\n\n

Yes. SAP addressed CVE-2026-44756 on its September 8, 2026 Security Patch Day. The fix is delivered through SAP Security Note 3747649, and a single kernel patch closes all of the affected protocol paths rather than requiring separate remediation per service.<\/p>\n\n\n\n

SAP has published two supporting references alongside the patch. Note 3776034 is an FAQ covering the vulnerability and the remediation path, and Note 3756304 documents an HTTP-specific workaround for environments that cannot patch immediately. The workaround narrows one protocol path and does not substitute for the kernel patch, since SAP GUI and RFC access remain reachable.<\/p>\n\n\n\n

Kernel patching typically requires a restart and is often tied to a change window, so organizations should confirm the exact target patch level for each kernel release in their landscape directly with SAP rather than assuming a uniform fix version across releases. As of publication there is no public evidence of exploitation in the wild, which makes the current window the useful one.<\/p>\n\n\n\n

Are there any other recommended actions to take?<\/h2>\n\n\n\n

Until patching is confirmed, defenders should:<\/p>\n\n\n\n