SAP Patches a CVSS 10.0 Kernel Flaw That Requires No Credentials

SAP's September security patch day, held September 8, looked routine on paper: 22 security notes. Four of the new notes were HotNews, SAP's top severity band, and one of them is about as bad as enterprise software flaws get.

Related reading: Microsoft's October 2026 Patch Tuesday Sets a Record With 1,407 Fixes · WordPress Patches Comment2Shell, a Comment Flaw That Can Lead to Server Takeover.

Tracked as CVE-2026-44756 and dubbed OVERPASS by the researchers who found it, the vulnerability is a memory-corruption flaw in the SAP kernel's processing of the Extended Passport (EPP), the standard tracing structure that clients attach to their requests. It carries the maximum possible CVSS score of 10.0. It is exploitable remotely and without authentication, exists by default across a wide range of SAP technology components, and allows an attacker to run arbitrary operating system commands on the SAP host with SAP administrative privileges, full compromise of the business data and processes underneath.

How it works

According to Onapsis Research Labs, which identified and responsibly disclosed the flaw, the bug is a missing boundary check during the deserialization of EPP data. When the kernel processes externally supplied length fields, the absence of validation causes a memory-safety violation. An unauthenticated attacker sends crafted network requests containing a malformed EPP header, triggering undefined behavior that can be turned into code execution.

SAP released the fix in Security Note 3747649, a kernel patch that, in Onapsis' assessment, closes every one of the described access routes in a single update. It covers ABAP and Java kernels as well as SAP Web Dispatcher version 9.16. Other Web Dispatcher versions, and Web Dispatcher as part of SAP HANA Extended Application Services, are not affected, SAP says. Affected kernels include the KRNL64NUC/KRNL64UC 7.22 through 8.04 lines and the main KERNEL branches from 7.22 through 9.20.

Onapsis estimates that more than 10,000 internet-facing SAP systems run the vulnerable component, according to BleepingComputer.

No exploitation, yet

As of September 9, Onapsis said it had not observed active in-the-wild exploitation, and SAP's notes make no mention of it either. That is the good news, and it is also the part with a short shelf life. Onapsis's own guidance notes that attackers have historically reverse-engineered SAP patches within about 72 hours, and that AI-assisted tooling is shrinking that window further.

The reference points are sobering. OVERPASS mirrors the 2022 ICMAD vulnerabilities, which also sat in shared SAP kernel code and also scored 10.0, and demonstrated how large the blast radius of a kernel flaw can be. The 2025 mass exploitation of CVE-2025-31324, which Mandiant's 2026 report called the most exploited vulnerability of the year, showed what happens when a critical pre-authentication SAP flaw is weaponized before defenders move.

What to do

The remediation is unusually clean for a flaw this severe. Onapsis recommends treating patching as an emergency priority:

• Inventory first. Check your SAP kernel release and patch level against Security Note 3747649, and treat any unpatched system as in scope.
• Apply the kernel patch. It is the definitive fix. Partial HTTP-level controls exist in companion notes (3756304 and 3776034), but Onapsis says only the kernel patch closes every exploitation path.
• Don't wait for a maintenance window you'll regret. Given the reachability from RFC and GUI layers, not only the web tier, there is no clean perimeter to hide behind.
• Watch for retooling. A 10.0 that needs no credentials is a high-value target for ransomware and initial-access brokers; the absence of exploitation today is not a forecast for next month.

The other HotNews notes from the same patch day are worth reviewing too: CVE-2026-58231 in SAP Commerce Cloud's Data Hub Adapter (also 10.0), CVE-2026-58240 (S4GET) in the NetWeaver Message Server (9.8), CVE-2026-76969 in the Cloud Application Programming Model (9.4), and CVE-2026-66768 in SAP GUI for Java (9.0).