CVE-2026-44756: SAP Kernel OVERPASS Maximum-Severity Buffer Overflow Advisory, 10,000+ Systems Exposed on the Public Internet
SAP's September security update patches 20 vulnerabilities. Kernel OVERPASS CVE-2026-44756 scores maximum severity: an unauthenticated attacker can execute arbitrary commands as administrator. Onapsis estimates 10,000+ systems exposed on the public internet.
SAP's September 2026 security update patched 20 vulnerabilities. SAP Kernel OVERPASS (CVE-2026-44756) received a maximum severity rating: an unauthenticated attacker can execute arbitrary commands as administrator on the affected host. Onapsis estimates more than 10,000 internet-facing SAP systems sit in the potential attack range.
Incident Overview
OVERPASS was discovered and reported by the Onapsis research team. It lives in SAP Kernel's Extended Passport Protocol (EPP) handling library. Root cause is a classic buffer overflow. The bug is triggerable via SAP Internet Communication Manager (ICM) — the networking component that attaches SAP NetWeaver application servers to HTTP, HTTPS, and SMTP, typically sitting directly in business traffic.
Technical Details
No valid credentials required. An attacker sends a crafted request through ICM, triggers memory corruption, and executes arbitrary commands as administrator on the SAP host — full takeover of the underlying SAP process and business data. Onapsis CTO JP Perez-Etchegoyen stated that high-fidelity fingerprinting identified more than 10,000 public IPs exposing SAP web interfaces, and the number is conservative — SAP Web Dispatcher returns no characteristic banner, so actual exposure is larger.
Also patched in the same batch: NetWeaver Message Server missing-authentication bug S4GET (CVE-2026-58240). An unauthenticated attacker can reach the entire system cluster via the same public port used by SAP GUI clients, and execute arbitrary commands as the adm user (the OS-level user that runs SAP) on every application server in the cluster. Attack traffic uses the same port as normal GUI logins, so a firewall cannot block it without interrupting end-user logins.
Impact Assessment
- CVE-2026-44756: maximum severity, buffer overflow, unauthenticated remote exploit, attack surface is ICM.
- CVE-2026-58240: missing authentication, unauthenticated cluster-wide RCE.
- SAP serves 99 of the world's 100 largest enterprises and carries core finance and business processes. Host compromise means direct exposure of critical business data.
- CISA has listed 14 SAP vulnerabilities in the Known Exploited Vulnerabilities catalog since November 2021; 3 were abused by ransomware groups. Last month's Commerce Cloud bug CVE-2026-58231 was exploited in the wild days after the patch shipped.
Remediation
- Apply the SAP September 2026 security update immediately. It is the only complete fix.
- Restrict public access to ICM through a WAF or reverse proxy. Expose only required business interfaces.
- Audit Message Server port exposure. Evaluate confining GUI access to intranet or VPN.
- Lesson from F5-class edge devices: compress patch cycles for SAP-class core business systems to days.
References
- BleepingComputer – SAP warns of maximum severity OVERPASS kernel vulnerability