SAP has released urgent security updates to fix a critical memory corruption flaw (CVE-2026-44756) that could allow unauthenticated attackers to gain total control over affected systems.
- CVE-2026-44756 carries a maximum CVSS severity score of 10/10.
- The 'OVERPASS' flaw allows remote code execution and credential theft without authentication.
- Impacts a wide array of products including S/4HANA, ERP, and NetWeaver.
Software giant SAP has released 20 new and updated security notes, headlined by a critical fix for a memory corruption vulnerability in Extended Passport (EPP) Processing. Tracked as CVE-2026-44756, the flaw has been assigned a perfect CVSS score of 10/10, indicating the highest possible risk level.
According to security firm Onapsis, the vulnerability, dubbed 'OVERPASS', stems from missing boundary validations during the deserialization of EPP data. This allows unauthenticated remote attackers to trigger unsafe memory behavior, leading to the ability to run arbitrary system commands and recover sensitive database credentials.
Why This Matters
BozokMedia analysis shows that the architectural placement of this flaw is what makes it catastrophic. Because the EPP processing occurs at the very beginning of a user session, it bypasses traditional security layers. User locks, authorization objects, and logon policies are only evaluated after the point where this flaw can be exploited, leaving the system wide open to attackers.
"The affected components run under the operating system account that owns the SAP installation, so code execution under it is equivalent to owning the SAP system outright."
The attack vectors are diverse, including web requests, the SAP GUI protocol, and Remote Function Call (RFC) connections. The scope of impact is vast, covering S/4HANA, ERP, Business Suite (ECC), NetWeaver, Web Dispatcher, BW/4HANA, Enterprise Portal, PI/PO, and Solution Manager.
In addition to OVERPASS, SAP addressed three other critical flaws. One of these, dubbed S4GET (CVE-2026-58240), involved a missing authentication check in NetWeaver that could allow attackers to register unauthorized components in S/4HANA 2025 and earlier releases.
| Vulnerability | CVE ID | Primary Impact | Severity |
|---|---|---|---|
| OVERPASS | CVE-2026-44756 | Full System Takeover | 10/10 (Critical) |
| S4GET | CVE-2026-58240 | Unauthorized Component Reg. | Critical |
Frequently Asked Questions
Q1: Has this vulnerability been exploited in the wild?
A: Currently, there are no known indicators from either Onapsis or SAP that the flaw has been exploited by malicious actors.
Q2: Which SAP products are most at risk?
A: Any product relying on the vulnerable kernel code, most notably S/4HANA and NetWeaver, is at high risk if not patched.
