SAP Patches Critical OVERPASS Vulnerability Rated CVSS 10.0

SAP has shipped a bundle of security updates, closing several vulnerabilities, including a maximum-severity flaw in the Extended Passport (EPP) handling mechanism. The issue has been assigned the identifier CVE-2026-44756 and the top-end score of CVSS 10.0. The vulnerability was discovered and reported to the vendor by Onapsis, a firm specializing in SAP security; it has been given the codename OVERPASS.

Full Compromise Without a Password

The bug lies in the SAP kernel code responsible for deserializing EPP data: the absence of bounds checking when handling externally supplied length fields leads to memory corruption. All an attacker needs to do is send a specially crafted network request with a malformed EPP header — and they can hijack the process and execute operating-system commands with SAP administrative privileges. No authentication is required.

The danger is compounded by the fact that EPP handling is shared kernel code used by several protocols at once. According to Onapsis CTO J. P. Perez-Etchegoyen, the vulnerability can be reached both from the web layer facing the internet and from the SAP GUI side, to which every user connects, as well as through the RFC layer that links SAP systems to one another. No network filter closes off the risk completely.

The consequences of a successful attack include reading SAP's secure store with database credentials and password hashes, accessing live user sessions, harvesting credentials for lateral movement into other SAP systems, and altering data, configuration, and the binary files themselves. Perez-Etchegoyen stresses in particular: the standard authorization and segregation-of-duties (SoD) mechanisms are powerless here, because the vulnerable code fires before any authentication check.

Three More Critical Flaws

The second most dangerous issue is CVE-2026-58240 (CVSS 9.8), which has been named S4GET. It is a logic error in the SAP NetWeaver Message Server, present in the 9.x kernel line that powers SAP S/4HANA and S/4HANA Cloud Private Edition. It is triggered through the same public port to which all SAP GUI clients connect, which means it cannot simply be closed off with a firewall without cutting off user logins. Successful exploitation grants remote code execution as <sid>adm on every server in the cluster.

Two more critical vulnerabilities are CVE-2026-76969 (CVSS 9.4), a credential disclosure in multi-tenant applications built on the SAP Cloud Application Programming Model, and CVE-2026-66768 (CVSS 9.0), an improper access control flaw in SAP GUI for Java that allows commands to be executed on the host.

No signs of exploitation in real-world attacks have been recorded so far, but Onapsis strongly recommends taking inventory of all SAP systems, patching internet-facing instances first, reducing the attack surface, and setting up monitoring for exploitation attempts.

Source: The Hacker News