Build1 publisher3 min readPublished
Extended Passport parsing puts SAP's CVSS 10.0 overflow ahead of every logon check
Onapsis says the OVERPASS overflow fires while the SAP kernel processes an Extended Passport at session initiation, which happens before authentication or logon policy is consulted. That leaves reachability and patch state as the only variables.
The Engineer · Build desk
What happened
- Onapsis rates the SAP kernel flaw it calls OVERPASS, CVE-2026-44756, at CVSS 10.0, describing a buffer overflow in Extended Passport processing that yields pre-authentication OS command execution.
- The overflow is reached in kernel code at session initiation, before authentication, roles or logon policies are evaluated, and neither a valid SAP account nor user interaction is needed.
- The remedy is the kernel patch in SAP Security Note 3747649, and the related product list covers SAP NetWeaver AS ABAP, Web Dispatcher, S/4HANA and ERP.
- Until patching completes, Onapsis advises restricting connection sources with SAProuter, jump hosts and Web Dispatcher, plus monitoring for application-layer anomalies.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- decision Patch sequencing now turns on network position instead of business criticality, because an internally reachable ERP instance and the internet-facing dispatcher are placed in one vulnerable scope, so the ranking exercise buys nothing.
- exposure Anyone already inside the network who can open an SAP GUI or RFC session has the same unauthenticated route as an external attacker at the ICM, which drags systems with no internet exposure into the same wave.
- cost Closing this costs a kernel patch cycle on every reachable instance, and the bill lands on whoever owns production maintenance windows rather than on the team that triaged the CVE.
- constraint Retrospective assurance is weak, because EPP contents may never have been written to a log, so a clean-looking review may only describe the logging configuration.
Everything an SAP team normally tunes to shrink blast radius sits downstream of this bug. Role design and logon policy are both evaluated after the Extended Passport structure has already been parsed at session initiation [2][3]. The commands land with the OS privileges of the SAP installation owner [4], and the impact list Onapsis publishes opens with database credentials, password hashes and active sessions [17].
Onapsis lays out what has to be true for this to work: a kernel without the fix from Security Note 3747649, a target process reachable over HTTP(S), SAP GUI or RFC, and application monitoring or network controls that do not stop the crafted EPP input [6]. Because no valid SAP account and no user interaction are required [5], every identity-shaped variable drops out and two are left, reachability and kernel patch state [19]. That is why the advice to start with internet-facing systems reads as sequencing and not as scoping: Onapsis places internal hosts reachable through SAP GUI or RFC in the same vulnerable scope [8].
The fix is a kernel patch [7], and the products named alongside it include NetWeaver AS ABAP, Web Dispatcher, S/4HANA and ERP [15].
The exposure runs across three protocols, and that splits the evidence into three separate trails instead of one [18]. The HTTP path goes through reverse-proxy and WAF logs, while SAP GUI and RFC have to be investigated separately [14]. EPP contents may not be recorded at all, depending on logging configuration [13]. The bar for confirmed execution is a suspicious child process or a shell running under the SAP owner account, and a crash on its own does not clear that bar [12][20]. On a lot of estates, a quiet review will mean nothing more than quiet logging.
The severity number still needs some qualifying. Onapsis marks the credential-theft and lateral-movement chain as inference and states that actual follow-on compromise has not been disclosed [11]. Its description of the trigger stops at a crafted structure sent to EPP processing at session initiation, with no packet count and no exploit mechanics [21]. The criteria it lists for attempted access, execution and follow-on compromise are things an investigator must confirm, not observations the advisory reports having made [20]. Onapsis published the write-up on 2026-09-08, alongside SAP's September 2026 Security Patch Day [16].
So the scheduling input is network position. The unpatched kernel a stranger can reach goes first, and the internally reachable SAP GUI and RFC systems follow in the same wave rather than in the next quarterly window, because Onapsis puts them in one scope [8]. Ranking those systems against each other by business criticality or by who holds which role does not change what an attacker needs, which is a route to session initiation [3][5].
What to watch
- A confirmed shell under an SAP owner account in the wild, since Onapsis says follow-on compromise has not been disclosed.
- Any EPP-level detection signature or filter that a Web Dispatcher or WAF can apply, given that current interim advice is reachability control only.
- Logging guidance that captures EPP contents, which today may go unrecorded depending on configuration.