Security1 publisher2 min readPublished
Unauthenticated SAP attackers hit memory corruption before any login check
Onapsis found CVE-2026-44756 in SAP's Extended Passport code, Pathlock and nullFaktor reproduced remote code execution in a lab, and technical write-ups went public within 48 hours of the patch. Mandiant's AI report is the week's other substance.
The Watch · Security desk
What happened
- CVE-2026-44756, rated maximum severity, sits in SAP's Extended Passport processing code and lets unauthenticated attackers trigger memory corruption before any login check runs.
- Onapsis found the bug and named it OVERPASS; Pathlock and nullFaktor warned that public technical write-ups appeared within 48 hours of the patch, lowering the bar for exploit development.
- Mandiant's 2026 AI Risk and Resilience report cites an incident in which a hijacked coding assistant helped spread a self-propagating worm across roughly 100 repositories.
- The same report details a corrupted value that sent an accounting agent into a runaway reasoning loop of more than 15,000 API calls and roughly $50,000 in cloud costs in under an hour.
- A Zurich court sentenced a Ukrainian IT specialist to nearly 13 years as lead developer of Lockergoga, MegaCortex and Nefilim, with prosecutors putting damages at roughly $123 million.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- exposure An SAP instance that processes Extended Passport traffic is reachable by anyone who can send it a request, so controls built on authentication, roles or session limits do not apply to this one.
- decision This week's queue splits into work that can be finished and work that cannot: the SAP flaw has a vendor fix and public write-ups racing it, while agentic intrusion has nothing to install.
- cost Mandiant's runaway accounting agent puts a dollar figure on agent failure with no intruder involved, and the cloud bill lands on whoever owns the agent's budget.
- capability With PhantomRaven's operator turning stolen CI/CD secrets into bounty submissions, a victim's first notice of compromise can arrive through its own bug bounty inbox.
No credential is required [1]. Pathlock and nullFaktor got their code execution over HTTP/HTTPS and NGRFC in lab conditions [3], so the reachable surface is every listener an owner has left exposed on those paths. The bug touches a wide range of SAP products [5].
Mandiant's contribution is a category. Its 2026 AI Risk and Resilience report says attackers have moved from prompting AI chatbots for research to letting autonomous agents run entire intrusions [6], and alongside the worm case it describes a compromised CI/CD credential that let an attacker co-debug exfiltration tools with an LLM in real time [8]. SecurityWeek's summary of the report is silent on the coding assistant, the repositories and the dates [21].
The third case in the report has no attacker in it. A corrupted value pushed an accounting agent into a runaway reasoning loop [9], and 15,000 calls inside sixty minutes works out to more than 250 a minute [1]. Raindrop, which sells detection for unknown failures in autonomous agents, closed a $35 million Series A on top of last year's $15 million seed [10][11], $50 million in total [2].
CI/CD secrets are where the week's two AI stories meet. CrowdStrike says PhantomRaven, an npm stealer pushed through typosquatted packages, harvests system details and CI/CD environment variables from GitHub Actions, GitLab CI, Jenkins and CircleCI [12], and assesses with high confidence that an LLM wrote the JavaScript, based on its verbose comments and placeholder code [13]. CrowdStrike found no evidence the stolen data is sold on criminal marketplaces, and says the operator uses it to flag compromises for bounty payouts [14].
Away from the agents, the Zurich court described the convicted developer's role as closer to a technical consultant than the operation's mastermind, and the verdict is subject to appeal [16][18]. Five leaders of the Cape Town chapter of Nigeria's Black Axe syndicate were extradited from South Africa to New Jersey over romance scams and advance-fee schemes run against US victims from 2011 to 2021 [19]. NIST and CISA published final joint guidance for federal agencies and cloud providers on protecting the signed tokens and identity assertions behind single sign-on, federation and API access [20].
What to watch
- Whether CVE-2026-44756 draws in-the-wild exploitation reports or a CISA KEV entry now that write-ups are public.
- Whether Mandiant or an affected repository owner names the hijacked coding assistant and the injection path.
- The appeal in the Zurich case, which could reopen the court's finding on the developer's role.