SAP Patches 'OVERPASS' Kernel Flaw With Maximum Severity Rating

SAP has released emergency security updates to address a maximum-severity memory corruption vulnerability dubbed "OVERPASS." The flaw, tracked as CVE-2026-44756, allows unauthenticated remote attackers to target the core of SAP's infrastructure, posing a significant risk to global enterprise operations.

The vulnerability is a buffer overflow (CWE-120) located within the Extended Passport (EPP) processing library of the SAP kernel. Because the flaw is triggered during the processing of EPP tracing structures before any authentication occurs, attackers can exploit it without valid credentials. The vulnerability is reachable via multiple communication vectors, including the HTTP web layer, the SAP GUI layer, and the RFC layer. SAP assigned the flaw a CVSS score of 10.0, the highest possible rating, reflecting its extreme severity.

A Pattern of Kernel Weaknesses

OVERPASS was discovered and responsibly disclosed by Onapsis Research Labs in late April 2026. The flaw is not an isolated incident but part of a recurring trend of critical pre-authentication memory bugs within SAP's network parsers. Just one month prior to the September 2026 patch cycle, SAP addressed a similar memory flaw, CVE-2026-34265, which was patched in August 2026.

The vulnerability affects a vast portion of the SAP install base because it resides in shared kernel code. This includes core solutions such as S/4HANA, SAP ERP, ECC, and NetWeaver. Specifically, affected components include various versions of the SAP Kernel and the SAP Web Dispatcher (versions 9.16, 9.18, 9.19, and 9.20). According to SAP Security Note 3747649, all kernel versions are affected, though the note specifically lists those still under active maintenance.

Industry Implications

The placement of this flaw in the SAP Web Dispatcher is particularly concerning, as this component frequently serves as the public-facing perimeter for corporate networks. Juan Perez Etchegoyen, CTO of Onapsis, noted that standard SAP authorizations and Segregation of Duties (SoD) controls are ineffective against this attack because the vulnerable code executes before the authentication step.

While SAP's official documentation emphasizes the risk of process crashes and denial-of-service (DoS) attacks, the nature of buffer overflows combined with a CVSS 10.0 rating suggests a higher potential for full system compromise. This could allow an attacker to undermine the confidentiality, integrity, and availability of the entire environment.

Next Steps for Administrators

SAP released the necessary security updates in September 2026 as part of a larger batch of 20 vulnerability fixes. Administrators are urged to prioritize the update of the SAP Kernel and Web Dispatcher to eliminate the entry point. Organizations should verify their current kernel versions against the maintenance list in the official security notes to ensure they are no longer running vulnerable code.