# SAP Patches Maximum-Severity OVERPASS Flaw in Its September Update Page: https://hirantha.me/blog/sap-patches-maximum-severity-overpass-flaw-in-its-september-update Published: 2026-09-09 Written by: hirantha.me Newsroom (AI-generated). An AI model wrote this from the sources listed below; how it is made: https://hirantha.me/about/newsroom Topics: sap, vulnerability management, cve-2026-44756, erp security, patch tuesday > SAP's September patch day fixes a maximum 10.0 severity flaw called OVERPASS that unauthenticated attackers can reach before any login check applies. ## What went wrong SAP (Systems, Applications, and Products in Data Processing) released its September 2026 Security Patch Day on September 8, and it carries a bug rated at the very top of the industry's severity scale: 10.0 out of 10.0 on the Common Vulnerability Scoring System (CVSS). Researchers have nicknamed it OVERPASS. It lives in a SAP kernel component that starts working before the software has decided whether the connecting user is allowed in at all. The flaw, tracked under the Common Vulnerabilities and Exposures (CVE) identifier CVE-2026-44756, sits in Extended Passport (EPP) Processing, a kernel-level tracing component that follows requests as they move through a SAP system. When EPP reads incoming data, it trusts a length field the client supplies without checking it against the size of the data actually sent. A crafted length value triggers memory corruption. Because EPP runs the moment a session opens, none of SAP's usual gatekeeping, user locks, assigned roles, authorization objects, or logon policies, has been evaluated yet. Onapsis, the security firm that analyzed the advisory, put it directly: every SAP control that decides who may do what "is evaluated later than the point where the flaw is reached." An attacker needs no credentials and no user interaction to reach it. ## How far the exposure reaches The bug affects SAP's kernel directly, across versions 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, and 9.16 through 9.20, plus the Web Dispatcher that many SAP deployments run in front of it. Because so many SAP products share that kernel, including S/4HANA, the older ECC and Business Suite, NetWeaver, BW/4HANA, Enterprise Portal, PI/PO, and Solution Manager, the practical reach extends well past any single product line. Systems that expose their Internet Communication Manager (ICM) directly to the public internet carry the most risk, since ICM is the component through which the flawed EPP code becomes reachable from outside. ## Three more critical bugs landed the same day OVERPASS was the headline, but it was one of 19 new security notes SAP published on September 8, plus an update to an older note, and four of the new notes were rated critical: - CVE-2026-44756 (OVERPASS), CVSS 10.0: the EPP memory corruption described above. - CVE-2026-58240, CVSS 9.8: a missing authentication check in the NetWeaver Message Server, affecting kernel builds 9.16, 9.18, 9.19, and 9.20. - CVE-2026-76969, CVSS 9.4: a credential disclosure bug in sap/cds-mtxs, a library used by multitenant applications built on the SAP Cloud Application Programming (CAP) model. - CVE-2026-66768, CVSS 9.0: an improper access control flaw in SAP GUI for Java, part of the NetWeaver stack, letting a low-privileged attacker gain unauthorized access after some user interaction. The remaining 15 notes cover lower-severity issues across products including SAP Integration Suite, Commerce Cloud, SAPUI5, and the Process Integration SOAP Adapter. ## No confirmed exploitation yet, and that is not the same as safe Onapsis says it has found no indicators that CVE-2026-44756 has been exploited in the wild. That is worth reading as a status update, not as reassurance. Unauthenticated, pre-login, remotely reachable bugs in widely deployed enterprise software are exactly the profile that draws fast reverse-engineering attention once a patch narrows down where the flaw sits, and the gap between patch release and working exploit code has been shrinking across the industry for this class of vulnerability. ## What it means in practice Any organization running an affected SAP kernel version should treat SAP Note 3747649 as an emergency change, not something to fold into the next maintenance window. 1. Patch the kernel. This fix changes how the kernel parses incoming data before authentication happens, so a workaround at the application layer will not substitute for it. 2. Check what is internet-facing. If ICM or Web Dispatcher is reachable from the open internet, restrict that access or place it behind a properly configured reverse proxy while the patch rolls out, even if patching itself happens quickly. 3. Ask vendors and partners. Organizations that rely on a third party's SAP environment, rather than running their own, should confirm this month's notes have actually been applied rather than assume it. SAP ships security notes on a monthly cadence, typically the second Tuesday of the month, and most fixes in a given month are routine. This one is not. ## Questions **What is the OVERPASS vulnerability in SAP?** OVERPASS is the nickname for CVE-2026-44756, a maximum-severity (CVSS 10.0) memory corruption flaw in SAP's Extended Passport Processing component that lets an unauthenticated attacker execute code before SAP's login checks run. **Which SAP products are affected?** The underlying kernel flaw touches any product built on the affected kernel versions, including S/4HANA, NetWeaver, the older ECC and Business Suite, BW/4HANA, Enterprise Portal, PI/PO, and Solution Manager, plus the Web Dispatcher. **Is OVERPASS being actively exploited?** Onapsis, which analyzed the flaw, says it has found no indicators of exploitation in the wild as of the advisory, though unauthenticated pre-login bugs like this one tend to draw exploit development quickly. **What should SAP administrators do right now?** Apply the kernel patch under SAP Note 3747649 as an emergency change, and audit whether the Internet Communication Manager or Web Dispatcher is reachable from the public internet. **What other bugs did SAP fix this month?** SAP fixed three other critical flaws on the same day: a missing authentication check in the NetWeaver Message Server, a credential disclosure bug in a CAP multitenant library, and an improper access control issue in SAP GUI for Java, alongside 15 lower-severity notes. ## Sources - [SAP Patches Critical Extended Passport Processing Vulnerability](https://www.securityweek.com/sap-patches-critical-extended-passport-processing-vulnerability/), SecurityWeek - [SAP September 2026 Security Update Fixes 4 Critical Vulnerabilities and 15 Other Flaws](https://gbhackers.com/sap-september-2026-security-update/), GBHackers - [SAP Security Updates September 2026](https://cybersecuritynews.com/sap-security-updates-september-2026/), Cybersecurity News