CVE-2026-44756: 
SAP NetWeaver Application Server ABAP vulnerability analysis and mitigation

CVE-2026-44756, dubbed "Overpass", is a critical memory safety vulnerability (CWE-120: Classic Buffer Overflow) in SAP's Extended Passport Protocol (EPP) processing library. An unauthenticated remote attacker can send a crafted network request containing a malformed EPP header to trigger undefined behavior and abnormal program termination, potentially enabling remote code execution. Affected products include SAP Extended Passport (EPP) Processing across a wide range of kernel versions: KRNL64NUC 7.22, KRNL64UC 7.22, KERNEL 7.22, 7.22EXT, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.16, 9.18, 9.19, 9.20, and WEBDISP 9.16. The vulnerability was published on September 8, 2026, and carries a CVSS v3.1 base score of 10.0 (Critical) (GitHub Advisory, SAP Note).

The root cause is a classic buffer overflow (CWE-120) in the EPP processing library, where input from a malformed EPP header is copied into a buffer without validating that the input size does not exceed the destination buffer's capacity. This allows an unauthenticated attacker to send a specially crafted network request over standard SAP protocols (including HTTP/HTTPS via Web Dispatcher and native SAP protocols) to overwrite adjacent memory, leading to undefined behavior, process crashes, or potentially arbitrary code execution. No authentication or user interaction is required, and attack complexity is low, making this trivially automatable. A full disclosure post was published on the Seclists Full Disclosure mailing list, and technical write-ups have been published by Onapsis, RedRays, SecurityBridge, and others (GitHub Advisory, Onapsis Remediation, RedRays Blog, Seclists).

Successful exploitation can result in high impact to confidentiality, integrity, and availability of the affected SAP application, with a changed scope indicating that components beyond the vulnerable EPP library itself may be affected. An unauthenticated attacker could crash SAP kernel processes (denial of service), potentially disclose sensitive memory contents, or achieve remote code execution — granting full control over the underlying SAP system. Given that SAP systems typically host critical business data (ERP, HR, financial records), compromise could enable lateral movement across enterprise environments and mass data exfiltration. Estimates suggest over 10,000 internet-facing SAP systems may be at risk (BleepingComputer, 4sysops).

As of the time of disclosure, no public proof-of-concept exploit code has been confirmed, and there is no evidence of active in-the-wild exploitation (GitHub Advisory). However, the vulnerability is rated automatable by NVD SSVC analysis, with total technical impact, meaning exploitation requires no special conditions beyond network access. The EPSS score is approximately 0.321%, reflecting a currently low but non-trivial probability of exploitation within 30 days. No specific threat actor attribution has been reported. The vulnerability has not yet been added to the CISA KEV catalog based on available data, though CERT-EU has issued a security advisory (CERT-EU).

1. Reconnaissance: Use tools such as Shodan, Censys, or Fofa to identify internet-facing SAP systems (Web Dispatcher, SAP NetWeaver) running vulnerable kernel versions (e.g., KERNEL 7.22–9.20, WEBDISP 9.16) by fingerprinting SAP-specific HTTP headers or service banners.
2. Identify EPP-enabled endpoints: Determine which SAP services process Extended Passport (EPP) headers — typically any SAP HTTP/HTTPS endpoint or native DIAG/RFC port where EPP propagation is enabled.
3. Craft malformed EPP header: Construct a network request (HTTP or native SAP protocol) containing a malformed EPP header with an oversized or malformed field designed to overflow the destination buffer in the EPP parsing library.
4. Send the crafted request: Transmit the request to the target SAP system without any authentication credentials. No user interaction on the target side is required.
5. Trigger undefined behavior: The EPP processing library copies the malformed header data without size validation, causing a buffer overflow that results in undefined behavior — ranging from process crash (DoS) to potential control-flow hijacking for RCE.
6. Achieve objective: Depending on memory layout and exploit refinement, the attacker may achieve denial of service (immediate crash), memory disclosure (sensitive data leakage), or remote code execution as the SAP kernel process user (Onapsis Remediation, RedRays Blog).

• Network: Unusual or malformed HTTP/HTTPS requests to SAP Web Dispatcher or NetWeaver endpoints containing oversized or structurally invalid EPP header fields; unexpected inbound connections to SAP DIAG (port 3200+) or RFC (port 3300+) from untrusted IP ranges.
• Logs: SAP system logs (dev_w*, dev_disp) showing abnormal program termination or memory access violations; repeated short-lived connection attempts from the same source IP; entries referencing EPP header parsing errors or core dumps.
• File System: Unexpected core dump files (e.g., core.*) in SAP work directories; new or modified files in SAP kernel directories following a crash event.
• Process: Unexpected termination and restart of SAP work processes (e.g., disp+work, gwrd, icman); child processes spawned by SAP kernel processes executing system commands (e.g., sh, bash, cmd.exe).
• Application: SAP system availability interruptions or short dumps (ST22) referencing memory-related errors in EPP processing components (Onapsis Remediation, SecurityBridge).

SAP has released patches via SAP Security Note 3747649, available through the SAP Support Portal (SAP Me). Organizations should apply the relevant kernel patch for their version immediately — patched versions are available for all affected kernel lines (KRNL64NUC 7.22, KRNL64UC 7.22, KERNEL 7.22/7.22EXT, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.16, 9.18, 9.19, 9.20, WEBDISP 9.16) (SAP Note, GitHub Advisory). As interim mitigations: implement network-level filtering to restrict EPP protocol traffic and SAP service ports to trusted IP ranges only; consider disabling EPP propagation if not required by business processes; and deploy Web Application Firewall (WAF) rules to detect and block malformed EPP headers. Monitor system logs for abnormal application terminations and core dumps as indicators of exploitation attempts (Onapsis Remediation).

The vulnerability received significant attention from the SAP security community and mainstream cybersecurity media. BleepingComputer, SecurityWeek, The Hacker News, and Infosecurity Magazine all covered the flaw, with BleepingComputer describing it as a "maximum severity Overpass kernel vulnerability" (BleepingComputer, SecurityWeek, The Hacker News). SAP security specialists Onapsis and SecurityBridge published dedicated remediation and technical analysis blogs, and RedRays released a detailed breakdown of the stack overflow mechanism (Onapsis Remediation, SecurityBridge, RedRays Blog). CERT-EU issued a formal security advisory, and the vulnerability was discussed on Mastodon, Reddit, and LinkedIn by security researchers highlighting the risk to over 10,000 internet-facing SAP systems (CERT-EU). The CIS also published an advisory noting the potential for remote code execution (CIS Advisory).