SAP Patches OVERPASS: Maximum-Severity Kernel Bug Opens ERP Systems to Unauthenticated RCE

SAP published its September 2026 patch set on September 9, 2026, including Security Note #3747649 for CVE-2026-44756, a maximum-severity vulnerability in the kernel of SAP ERP systems that enables unauthenticated remote execution of arbitrary commands with administrative privileges. The flaw, discovered and reported by Onapsis Research Labs under the codename OVERPASS, affects deserialization of the Extended Passport Protocol, an internal tracing mechanism that processes session headers before any access controls are evaluated. Onapsis estimates over 10,000 internet-reachable SAP systems run the vulnerable component, and describes the figure as conservative.

How the Attack Works: The Tracing Protocol That Opens Before the Gate

The core of the vulnerability is a buffer overflow in the Extended Passport Protocol (EPP) processing library, classified as CWE-120 in the CVE.org record. EPP is an internal SAP tracing mechanism that carries session metadata in headers processed when a connection opens. Missing boundary validation on externally supplied length fields allows memory overwrite during deserialization.

The sequence is critical for security posture: EPP parsing occurs before any authentication, authorization, or access-policy evaluation. According to Onapsis analysis cited by SecurityWeek, "every SAP control that decides who may do what, including user locks, roles, authorization objects, and logon policies, is evaluated later than the point where the flaw is reached. None of them is in the attacker's way." The vulnerable component runs under the adm operating account, which manages the entire SAP installation; code execution in this context equals full system control.

The attack surface spans multiple protocols. SAP's Internet Communication Manager (ICM) exposes the flaw over HTTP and HTTPS, but the vulnerability is also reachable through the SAP GUI protocol and RFC connections. This multiplicity of vectors amplifies the difficulty of perimeter mitigation: restricting web access alone is insufficient because the kernel processes EPP regardless of the channel used.

"Because EPP is processed as the session opens, every SAP control that decides who may do what, including user locks, roles, authorization objects, and logon policies, is evaluated later than the point where the flaw is reached. None of them is in the attacker's way" — Onapsis Research Labs, via SecurityWeek

The Scale of Exposure: Over 10,000 Systems, and the Count Is Structurally Incomplete

JP Perez-Etchegoyen, CTO of Onapsis, quantified the exposure with a precision that underscores the limits of the measurement itself: "A targeted search with high-fidelity fingerprinting identifies more than 10,000 unique internet-reachable IP addresses with a SAP web interface, and that figure is conservative." The conservatism is structural, not rhetorical: the count covers only HTTP-reachable systems and materially undercounts SAP Web Dispatcher, which acts as a proxy to backends and does not return identifying SAP banners on the root path, making correct attribution impossible for internet-wide scanners.

Even in its incompleteness, the number establishes that the attack surface is concrete and distributed. ERP systems are among the most critical assets of large organizations: SAP states it serves 99 of the world's 100 largest companies. Compromise of an SAP system is not a single-application incident; it grants access to financial processes, logistics, human resources, customer data, and regulatory reporting.

September Patch Day: OVERPASS in the Context of SAP Patches

The September 2026 SAP Patch Day released between 20 and 22 security patches, depending on the source: BleepingComputer and SecurityWeek report 20, while Onapsis indicates 22. Note #3747649 for OVERPASS is classified HotNews, the vendor's highest severity category. The patch day also includes 5 HotNews and 6 High Priority notes, according to Onapsis. Onapsis collaborated on 8 patches in this cycle, with 6 notes published in co-disclosure.

In the same patch day, SAP also fixed CVE-2026-58240 (S4GET), a missing-authentication vulnerability in NetWeaver Message Server with CVSS 9.8, also discovered by Onapsis. Although its severity is near-maximum, the technical distinction matters: S4GET requires specific configuration conditions, whereas OVERPASS is pre-authentication and requires no preconditions.

The CVE-2026-44756 record on CVE.org confirms the full vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The S:C (Scope Changed) indicator is particularly significant: impact extends beyond the vulnerable component and propagates to the underlying operating system.

What to Do Now

Apply the patch for SAP Note #3747649 with maximum priority. The patch is available for ABAP and Java kernels and for SAP Web Dispatcher version 9.16. Affected kernel versions listed in the official advisory are: KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.22EXT, 7.53, 8.04, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.16, 9.18, 9.19, 9.20, WEBDISP 9.16, 9.18, 9.19, 9.20.

Verify that the system uses an affected Web Dispatcher version. Version 9.16 is vulnerable; other Web Dispatcher versions and HANA Extended Application Services are not affected, per Onapsis analysis.

Do not rely on network or access controls as a substitute mitigation. Because EPP parsing occurs before authentication, firewalls, VPNs, network segmentation, or user-lock policies do not prevent exploitation. The patch is the only effective countermeasure.

Check for internet-exposed SAP systems, including those behind Web Dispatcher. The estimate of 10,000 HTTP-reachable systems is a lower bound; internal reconnaissance must include proxies that do not expose identifying banners.

Why Pre-Authentication Changes Everything: A Read on ERP Posture

The maximum severity of OVERPASS stems not only from its CVSS 10.0, but from its architectural position. Most ERP vulnerabilities require at least valid credentials, a compromised account, or a misconfiguration. OVERPASS bypasses that layer: the tracing protocol, designed to support debugging and monitoring, becomes an execution tunnel. SAP's security model is hierarchical, with controls activating in sequence; the flaw precedes every sequence.

The absence of evidence of in-the-wild exploitation, confirmed by both Onapsis and SAP, is a current fact, not a guarantee. The complexity of a buffer-overflow exploit in binary deserialization is technically high, but the reward — administrative control of ERP systems — is maximal. The window between disclosure and potential exploitation measures in days, not months, for vulnerabilities of this severity against targets of this value.

The exposure structure itself, with thousands of internet-reachable systems and an uncounted number of scanner-invisible proxies, indicates the risk is not contained. The ERP sector has traditionally operated on assumptions of internal networks and controlled access; OVERPASS demonstrates that a single kernel bug can invalidate that assumption regardless of the network topology adopted.

Sources

• https://www.bleepingcomputer.com/news/security/sap-warns-of-maximum-severity-overpass-kernel-vulnerability/
• https://onapsis.com/blog/sap-security-patch-day-september-2026/
• https://www.securityweek.com/sap-patches-critical-extended-passport-processing-vulnerability/
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/september-2026.html?isu_page=1
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/august-2026.html
• https://nvd.nist.gov/vuln/detail/CVE-2026-58240
• https://nvd.nist.gov/vuln/detail/CVE-2026-58231
• https://nvd.nist.gov/vuln/detail/CVE-2026-2332
• https://www.cve.org/CVERecord?id=CVE-2026-44756
• https://www.cve.org/CVERecord?id=CVE-2026-58231

Information verified against cited sources and current as of publication.

Sources