The SAP OVERPASS vulnerability is CVE-2026-44756, a critical SAP Extended Passport processing flaw fixed by SAP Security Note 3747649 on September 8, 2026. SAP rated it CVSS 10.0. If exploited, it can let an unauthenticated attacker reach kernel-level code before login and, according to Onapsis, execute operating-system commands in the SAP installation owner or admin context.
What the SAP OVERPASS vulnerability actually is
CVE-2026-44756 is a memory-corruption vulnerability in SAP Kernel library code that processes SAP Extended Passport data, often shortened to EPP. CERT-EU described the bug on September 9, 2026 as missing boundary validation during EPP deserialization, allowing an unauthenticated attacker to send a malformed EPP header.
Onapsis, which named the issue OVERPASS and said it responsibly disclosed the flaw to SAP, gives the practical reason administrators should care: EPP processing happens at session opening, before authentication. Your locked users, SAP roles, authorization objects, password policy, logon rules, and segregation-of-duties controls sit on the wrong side of the trust boundary.
That is why the SAP OVERPASS vulnerability is not just another scary CVSS score. It attacks infrastructure that many SAP teams treat as plumbing: Kernel, Internet Communication Manager, Web Dispatcher, SAP Dispatcher, and RFC paths. Plumbing breaks differently. When it fails, a lot of business logic never gets a vote.
Exposure paths: ICM, Web Dispatcher, SAP GUI, and RFC
SAP Help describes Internet Communication Manager, or ICM, as the SAP NetWeaver application-server component that receives and sends web requests such as HTTP and HTTPS. In many environments, that makes ICM or SAP Web Dispatcher the first SAP-speaking component touched by a browser, reverse proxy, integration tool, or scanning host.
On September 8, 2026, Onapsis reported that OVERPASS is reachable through SAP Internet Communication Manager and SAP Web Dispatcher over HTTP(S), through SAP Dispatcher via the SAP GUI protocol, and through RFC. Its key point for defenders is uncomfortable: those routes converge on the same shared EPP kernel-code flaw.
Blocking one door helps. It doesn’t close the building. If your team removes public HTTP(S) exposure but leaves internal RFC paths widely reachable from application subnets, the SAP OVERPASS vulnerability still deserves urgent patching rather than a ticket marked “network mitigated.”
There is also an admin-interface wrinkle that generic advisories often skip. SAP Help documents browser-based administration of SAP Web Dispatcher and ICM through /sap/admin, with the icm/HTTP/admin_<xx> parameter controlling exposure by host, port, and client host. That interface is not the vulnerability, but after a kernel-level issue it becomes part of your blast-radius review: who can reach SAP management surfaces, from where, and through which dispatcher path?
Affected SAP versions and September 2026 patch data
SAP published the fix during its September 2026 Security Patch Day, which fell on September 8 because SAP schedules Patch Day for the second Tuesday of each month. The same bulletin included 19 new Security Notes and one update to a previously released note.
Security Note 3747649 covers CVE-2026-44756. In the same September 2026 bulletin, SAP also listed CVE-2026-58240 in SAP NetWeaver Message Server as Critical with CVSS 9.8, fixed by Security Note 3759472. CERT-EU urged organizations to apply both notes as soon as possible.
| Item | 2026 source detail | Why it matters |
|---|---|---|
| CVE-2026-44756 | SAP Security Note 3747649, CVSS 10.0 | Main SAP OVERPASS vulnerability; memory corruption in EPP processing |
| Affected kernel lines | KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.16, 9.18, 9.19, 9.20 | Broad footprint across SAP estates, including older and newer kernel tracks |
| Other affected packages | KRNL64NUC 7.22, 7.22EXT; KRNL64UC 7.22, 7.22EXT, 7.53, 8.04; WEBDISP 9.16, 9.18, 9.19, 9.20 | Web Dispatcher and Unicode/non-Unicode kernel packages need inventory, not assumptions |
| CVE-2026-58240 | SAP Security Note 3759472, CVSS 9.8 | Separate Critical NetWeaver Message Server issue in the same patch cycle |
| Public exposure signal | Onapsis reported more than 10,000 unique public IPs presenting an SAP web interface | Likely undercounts Web Dispatcher exposure, according to Onapsis |
The affected footprint, according to Onapsis, should be assumed across systems using SAP Kernel until you verify otherwise. That means SAP S/4HANA, SAP ERP/ECC, SAP Business Suite, NetWeaver AS ABAP, Web Dispatcher, BW/4HANA, Enterprise Portal, PI/PO, and Solution Manager belong in the first inventory pass.
Why this is worse than a generic server RCE
A remote command execution bug on an ordinary web server is bad. In SAP, the same class of outcome can sit much closer to money, regulated data, manufacturing, procurement, payroll, and identity propagation than many perimeter teams realize.
Onapsis said successful exploitation can run operating-system commands as the SAP installation owner or admin context. From there, the attacker may gain access to the SAP secure store, database credentials, password hashes, live session data, application data, configuration, and SAP binaries. That is not merely shell access. It is a route toward business-process control.
Here is the calculation I would use in a patch bridge: if a company has 42 SAP instances and each has three reachable protocol surfaces to validate, that is 126 exposure checks before you even count non-production systems, Web Dispatcher tiers, or inherited firewall rules. A “we patched production ECC” update sounds reassuring until someone asks about Solution Manager, BW, old training clients, and RFC paths from integration middleware.
For detection teams, the closest analogy is not a website defacement. It is a privileged platform compromise where the attacker may touch credentials and application state before normal SAP authorization telemetry tells a clean story. If your monitoring is heavily account-centric, read that twice. Our guide to SIEM-based threat detection is relevant here because the useful evidence may sit across SAP logs, EDR, network flow, and operating-system process records.
Patch first, then reduce reachable paths
Only the kernel patch closes all confirmed vectors, based on Onapsis’ September 2026 guidance. Restricting one protocol narrows exposure, but it does not remove the bug from the shared EPP processing code.
Prioritize internet-facing Web Dispatcher and ICM systems first, then systems reachable from partner networks, VPN pools, integration zones, jump hosts, and administrator workstations. Honestly, “internal only” is a weak comfort if your internal SAP network still trusts broad office ranges or old middleware servers nobody wants to reboot.
Use this practical order of operations:
- Identify every SAP Kernel and Web Dispatcher instance, including non-production, disaster recovery, sandbox, and legacy hosts.
- Confirm whether each instance matches an affected package or kernel line listed in SAP Security Note 3747649.
- Apply the fixed SAP kernel or Web Dispatcher level through your normal SAP maintenance process, with change records tied to the specific SID and host.
- Inventory HTTP(S), SAP GUI/Dispatcher, and RFC reachability to each system after patching, not before.
- Review
/sap/adminandicm/HTTP/admin_<xx>restrictions so management interfaces are limited by host, port, and client source. - Hunt for suspicious activity by the SAP OS account: unexpected child processes, secure-store reads, binary changes, credential access, new privileged SAP users, and unusual RFC or trusted-system activity.
Patch sequencing should also include the separate CVE-2026-58240 Message Server issue if your environment is affected. CERT-EU’s advisory grouped Notes 3747649 and 3759472 for immediate action, and that pairing makes sense operationally because both touch high-trust SAP infrastructure components.
Change teams sometimes resist emergency kernel work because SAP downtime has business cost. Fair. But this is one of those cases where the cost comparison is lopsided: a planned maintenance window is painful, while an SAP OS-owner compromise can turn into credential theft, transaction manipulation, and weeks of trust rebuilding.
Post-patch verification for SAP and security teams
After patching the SAP OVERPASS vulnerability, do not stop at “version upgraded.” Verify the exact runtime level on every kernel and Web Dispatcher instance, because SAP estates often contain side systems that are invisible to central business owners but very visible to attackers.
Security teams should map trust boundaries rather than draw a simple internet-versus-internal diagram. ICM and Web Dispatcher handle HTTP(S). SAP Dispatcher handles SAP GUI traffic. RFC routes often connect batch jobs, integration platforms, monitoring tools, and trusted systems. A compromise through one path can have consequences in another.
For a wider architecture discussion, the principle in trust verification and Zero Trust design applies cleanly to SAP: treat protocol reachability as a privilege, not a network default. The same goes for behavior monitoring; UEBA-style account and entity analytics can help spot new privileged users, odd administrator timing, or anomalous RFC behavior after a suspected exposure window.
Look backward as well as forward. Onapsis said it had not observed active in-the-wild exploitation as of its September 8, 2026 publication, but absence of known exploitation is not proof that your environment was untouched. Review EDR and system logs for unusual SAP OS-account process execution, credential-store access, SAP binary modification, and new outbound connections from SAP hosts.
Software supply-chain thinking also matters. If attackers can alter SAP binaries or configuration, you need integrity checks and trusted update paths; the risk logic resembles cases where infrastructure trust is abused, as in BGP hijacking against software updates. Different technique, same uncomfortable lesson: trusted delivery and trusted runtime are both security dependencies.
FAQ: SAP OVERPASS vulnerability
What is the SAP OVERPASS vulnerability?
The SAP OVERPASS vulnerability is CVE-2026-44756, a CVSS 10.0 memory-corruption flaw in SAP Extended Passport processing. SAP fixed it with Security Note 3747649 on September 8, 2026.
Can CVE-2026-44756 be exploited without SAP login credentials?
Yes, according to CERT-EU and Onapsis descriptions, the malformed EPP data can be sent before authentication. Onapsis said SAP roles, locked users, password policy, and authorization objects do not block that exploit path.
Which SAP systems should administrators check first?
Start with internet-facing SAP Web Dispatcher and ICM systems, then SAP GUI/Dispatcher and RFC-reachable systems. Include S/4HANA, ECC, BW/4HANA, PI/PO, Enterprise Portal, Solution Manager, non-production, and disaster-recovery instances until verified.
Does blocking HTTP access fix OVERPASS?
No. Restricting HTTP(S) can reduce exposure, but Onapsis reported that SAP GUI and RFC paths can also reach the same shared EPP kernel flaw. The kernel patch is the confirmed fix across vectors.
What should teams check after applying SAP Security Note 3747649?
Confirm every affected kernel and Web Dispatcher instance is at a fixed level, verify protocol exposure, restrict /sap/admin access, and hunt for unusual SAP OS-account execution, credential access, binary changes, new privileged users, and unexpected RFC activity.
EN 
FR 
ES