SAProuter

Extended Passport parsing puts SAP's CVSS 10.0 overflow ahead of every logon check

Onapsis says the OVERPASS overflow fires while the SAP kernel processes an Extended Passport at session initiation, which happens before authentication or logon policy is consulted. That leaves reachability and patch state as the only variables.