CVE-2026-44756: 
SAP NetWeaver Application Server ABAP Analisi e mitigazione delle vulnerabilità

CVE-2026-44756 is a critical memory safety vulnerability in SAP's Extended Passport Protocol (EPP) processing library that allows unauthenticated remote attackers to trigger undefined behavior and abnormal program termination via a crafted network request containing a malformed EPP header. It was published on September 8, 2026, as part of SAP's September 2026 Security Patch Day. Affected products include SAP KERNEL versions 7.22, 7.54, 7.77, 7.89, 7.93, and 9.16; KRNL64NUC 7.22 and 7.22EXT; KRNL64UC 7.22 and 7.53; WEBDISP 9.16, 9.18, 9.19, and 9.20; and KERNEL 8.04. The vulnerability carries a CVSS v3.1 base score of 10.0 (Critical) (GitHub Advisory, SAP Security Note).

The root cause is classified as CWE-120 (Buffer Copy without Checking Size of Input / Classic Buffer Overflow): the EPP processing library copies an input buffer to an output buffer without verifying that the input size does not exceed the output buffer's capacity. An unauthenticated attacker can send a specially crafted network request with a malformed EPP header that triggers this unchecked copy, leading to memory corruption, undefined behavior, and potential arbitrary code execution. No authentication, user interaction, or special privileges are required, and the attack vector is fully network-accessible with low complexity. The scope is marked as Changed, indicating that a successful exploit can affect resources beyond the vulnerable component itself (GitHub Advisory, SAP Security Note).

Successful exploitation can result in high impact to confidentiality, integrity, and availability of the affected SAP application. Memory corruption caused by the buffer overflow may enable arbitrary code execution under the context of the SAP kernel process, potentially granting an attacker full control over the affected system. Given that SAP systems typically host sensitive enterprise data (financial records, HR data, business processes), a compromise could facilitate data exfiltration, lateral movement within the enterprise network, and disruption of critical business operations (GitHub Advisory, SAP Security Note).

As of the disclosure date (September 8, 2026), there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (GitHub Advisory). The vulnerability is rated as automatable (no user interaction required) with a network attack vector and no privileges required, making it highly attractive for weaponization. The EPSS score is currently 0.0, reflecting the absence of observed exploitation activity at time of publication. The CVE has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog as of the disclosure date. No threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing or network-accessible SAP systems running affected kernel versions (KERNEL 7.22, 7.54, 7.77, 7.89, 7.93, 9.16; KRNL64NUC/KRNL64UC 7.22; WEBDISP 9.16–9.20; KERNEL 8.04) using tools such as Shodan, Censys, or internal network scanning.
2. Identify EPP endpoint: Locate the network service or port on the target SAP system that processes Extended Passport Protocol (EPP) headers, typically exposed via SAP Web Dispatcher or SAP kernel network interfaces.
3. Craft malformed EPP header: Construct a network request containing a malformed EPP header with an oversized or specially structured payload designed to overflow the internal buffer during the unchecked copy operation (CWE-120).
4. Send crafted request: Transmit the malformed request to the target SAP service without any authentication credentials or prior session establishment.
5. Trigger memory corruption: The EPP processing library copies the malformed header into a fixed-size output buffer without size validation, causing a buffer overflow that results in memory corruption or undefined behavior.
6. Achieve objective: Depending on memory layout and exploit precision, the attacker may cause a denial-of-service (application crash) or, with a more refined payload, achieve arbitrary code execution under the SAP kernel process context (GitHub Advisory, SAP Security Note).

• Network: Unusual or malformed network requests targeting SAP Web Dispatcher or SAP kernel EPP processing ports from unexpected source IPs; anomalous traffic patterns with oversized or malformed EPP headers.
• Logs: SAP system logs (dev_w*, dev_disp) showing abnormal termination or core dumps related to EPP header processing; repeated connection attempts to EPP-handling services from a single external source.
• Process: Unexpected crashes or restarts of SAP work processes (e.g., disp+work, gwrd) or Web Dispatcher processes; core dump files generated in the SAP instance directory following network activity.
• File System: Presence of unexpected core dump files (e.g., core.*) in SAP instance or work directories; new or modified files in SAP installation directories following a crash event.

SAP has released patches addressing CVE-2026-44756 as part of the September 2026 Security Patch Day; administrators should apply SAP Security Note 3747649 immediately via the SAP Support Portal (SAP Security Note, SAP Patch Day). As a network-level workaround, restrict EPP protocol traffic to trusted internal sources using firewalls or SAP Web Dispatcher access control lists to reduce the attack surface. Monitor for abnormal EPP request patterns and unexpected application crashes. Consider running EPP processing in a sandboxed or isolated environment to limit the blast radius of potential exploitation until patching is complete.

The vulnerability received broad coverage from the security community following SAP's September 2026 Patch Day. Security outlets including GBHackers, CyberPress, SecurityOnline, CyberSecurityNews, and The Stack Technology highlighted CVE-2026-44756 as one of the most severe issues in the release, with The Stack Technology specifically noting the CVSS 10.0 score in its headline. SAP security specialists Onapsis and SecurityBridge published dedicated patch day analyses covering this vulnerability. Social media activity on Mastodon (infosec.exchange, mastodon.social) reflected community concern given the critical severity and unauthenticated network attack vector.