SAP OVERPASS: CVSS 10.0 Kernel Flaw Enables Pre-Auth Remote Code Execution

Enterprise resource planning (ERP) giant SAP has issued an emergency maximum-severity security patch resolving a critical memory corruption flaw in the SAP Kernel. Tracked as CVE-2026-44756 and codenamed OVERPASS by discovering researchers at Onapsis Research Labs, the vulnerability carries a CVSS 4.0 score of 10.0 and allows unauthenticated network attackers to achieve arbitrary remote code execution on the underlying host operating system.

The flaw resides in the SAP Kernel's deserialization logic for Extended Passport (EPP) headers. EPP is a tracing and telemetry mechanism introduced across SAP NetWeaver to monitor end-to-end performance and session handoffs between distributed SAP components, such as the SAP Web Dispatcher, Internet Communication Manager (ICM), and ABAP Application Servers.

Vulnerability Mechanism: Deserialization Boundary Mismatch

When an incoming HTTP/HTTPS or DIAG protocol packet reaches the SAP dispatcher, the kernel unpacks the EPP passport header before any application-level authentication handshake occurs. CVE-2026-44756 stems from a missing boundary check when parsing user-controlled length indicators inside the serialized passport stream:

// Pseudocode representation of the vulnerable EPP parsing routine
void parse_epp_passport(char *packet_stream, int max_packet_len) {
    uint16_t header_type = read_u16(packet_stream);
    uint32_t chunk_length = read_u32(packet_stream + 2); // Attacker controlled

    // Missing validation: chunk_length exceeds allocated stack buffer
    char epp_buffer[512];
    memcpy(epp_buffer, packet_stream + 6, chunk_length); // Buffer overflow triggers RIP control
}

By supplying a malformed chunk length, an external attacker can overflow the memory heap and stack buffers, corrupt execution pointers, and pivot execution directly into shellcode executed with the privileges of the SAP system administrator account (such as <sid>adm or root).

Threat Scope and Impacted Architecture

Operational Mitigation Requirements

Because the vulnerability is processed at the protocol layer before authentication or application filtering, standard Web Application Firewall (WAF) rule sets and SAP Application Server security roles cannot reliably block weaponized EPP payloads. Enterprise infrastructure teams must apply the following remediation protocol immediately:

• Apply SAP Security Note 3498871: Deploy updated SAP Kernel binaries across all Application Servers, Central Services (ASCS/SCS), and Standalone Web Dispatchers.
• Isolate SAP Dispatcher Ports: Ensure DIAG (32xx), RFC (33xx), and ICM HTTP/HTTPS (80xx, 443xx) interfaces are strictly restricted to trusted internal networks and VPN concentrators, removing any direct exposure to the public internet.
• Review Kernel Audit Logs: Inspect dev_disp and dev_icm developer trace logs for abnormal termination events, segmentation faults, or buffer boundary exceptions associated with EPP processing.