SAP OVERPASS CVE-2026-44756: Pre-Auth RCE Threatens 10,000 Internet-Facing ERP Systems

The Extended Passport Protocol is a SAP-proprietary tracing mechanism that records call sequences across distributed SAP landscapes. SAP creates an EPP token when a session opens, before any credential validation takes place. That design makes EPP code a pre-authentication attack surface reachable through every protocol a SAP system speaks.

CVE-2026-44756 is a classic missing boundary check during EPP deserialization. When the SAP kernel receives an EPP structure whose externally supplied length field exceeds the allocated buffer, it does not validate the field before writing data into memory. The resulting heap corruption overwrites adjacent process memory in a way that redirects execution flow, giving the attacker control of the process running as the SAP OS account (typically named <sid>adm on Linux or the equivalent Windows service account). From that account, the attacker can read every database table, dump credentials for all connected systems, and move laterally to adjacent SAP instances via RFC trust relationships.

The three exploitation routes reflect EPP's reach across SAP's network stack:

Route 1: HTTP/Web layer. Requests to SAP Internet Communication Manager (ICM), including the Fiori launchpad, WebGUI, REST APIs, and OData services, carry EPP data before authentication. Any internet-facing ICM port is directly exploitable.

Route 2: SAP GUI (Dispatcher). The dispatcher port (32XX) that every end user connects to for their SAP GUI session also processes EPP. Blocking this port disables user logon, so traditional firewall segmentation alone cannot remediate the GUI route.

Route 3: RFC layer. System-to-system RFC calls between SAP instances carry EPP tokens. An attacker with access to any trusted SAP instance in an RFC landscape can pivot laterally to all connected systems without additional credentials.

A single kernel patch (Security Note 3747649) closes all three routes by correcting the boundary validation in the EPP processing library.

OVERPASS lives in the SAP kernel, a shared code component that underlies every ABAP-based SAP product. There is no exception for cloud-hosted or managed instances.

Affected products include SAP S/4HANA, SAP ERP and Business Suite (ECC), SAP NetWeaver Application Server ABAP, SAP Web Dispatcher, SAP BW/4HANA, SAP Enterprise Portal, SAP PI/PO, and SAP Solution Manager. Organizations running SAP Extended Application Services (XSA) and SAP HANA-based ABAP systems are also affected.

SAP's September 2026 Patch Day also closed CVE-2026-58240 (S4GET, CVSS 9.8) in the SAP NetWeaver Message Server and two additional critical flaws: CVE-2026-76969 (CVSS 9.4, credential disclosure in multi-tenant SAP CAP applications) and CVE-2026-66768 (CVSS 9.0, improper access control in SAP NetWeaver GUI for Java enabling arbitrary command execution). All four require the same urgency of response.

To determine whether your systems are patched, check the kernel release and patch level of each SAP instance against the ranges documented in SAP Security Note 3747649. Onapsis also published a free OVERPASS exposure scan available through the Onapsis Platform that inventories kernel build levels across your landscape. Internet-facing systems must be prioritized: any ICM port reachable from the internet without a Web Dispatcher in front represents immediate CVSS 10.0 exposure.

CVE-2026-58240, named S4GET by Onapsis, is a missing authentication check in the SAP NetWeaver Message Server that scores CVSS 9.8 and gives unauthenticated attackers remote code execution as the <sid>adm OS user across entire application server clusters.

The Message Server is the internal coordinator for SAP application server instances. It manages load balancing, session routing, and inter-instance communication. Every SAP work process and every SAP user session passes through it. The S4GET flaw allows an unauthenticated attacker to interact with the Message Server without presenting any credentials, certificate, or configuration token, and to execute arbitrary commands that propagate across the entire cluster.

The critical operational constraint: the Message Server port (typically 39XX for the internal port and 36XX for the external logon port) cannot be blocked with a firewall without breaking SAP GUI user logon. Every employee logging into SAP connects through the logon load balancer, which goes through the Message Server. This means network-layer controls alone cannot eliminate S4GET exposure for operational SAP systems. The only remediation is the kernel patch from September 2026 Patch Day.

See also: our coverage of the N-able N-central CVE-2026-86218 pre-auth RCE in MSP tooling for the pattern of pre-auth vulnerabilities in enterprise management infrastructure that attackers prioritize for maximum downstream impact.

CISA has catalogued 14 SAP vulnerabilities exploited in the wild since 2021. Three served as direct initial-access vectors for ransomware operators. The pattern is consistent: a high-severity SAP flaw is disclosed with a patch available, organizations delay because SAP patching requires maintenance windows and business sign-off, and threat actors reverse-engineer the fix to develop exploits within days of disclosure.

SAP environments are uniquely attractive ransomware targets. A single compromised SAP system gives attackers access to every financial record, payroll file, supply chain order, and HR dataset the organization manages. SAP HANA databases store primary financial ledgers. RFC trust chains connect production, quality assurance, and development systems, allowing lateral movement without additional credentials. SAP Solution Manager, often deployed as the landscape manager, controls every other SAP instance. Compromising it once gives attackers privileged access to the entire SAP estate.

The Clop, ALPHV/BlackCat, and LockBit ransomware groups have all included SAP-specific reconnaissance steps in their documented TTPs. The BlackCat variant targeting professional services firms in 2025 specifically dumped SAP ABAP credentials after initial network access to accelerate lateral movement. OVERPASS eliminates the need for that initial network access step entirely.

No threat actor infrastructure indicators (C2 IPs, domains, or file hashes) have been published for CVE-2026-44756 exploitation at time of writing. Onapsis confirmed active exploitation has not yet been observed in the wild as of September 2026 Patch Day. The indicators below are behavioral and structural, derived from the known attack mechanics of OVERPASS exploitation. Deploy them proactively while you execute the patching workflow.

The highest-confidence indicator is unexpected child process creation from SAP ICM or work processes. In normal SAP operation, icman (the Internet Communication Manager daemon) and disp+work (the dispatcher/work process) should never spawn interactive shells, scripting runtimes, or network utilities. Any such activity is a strong signal of post-exploitation activity.

Monitor SAP system logs (SM21, SM50, SMICM) for unusual inbound connection volumes to ICM endpoints and unexpected process spawning events. Enable kernel-level process auditing (auditd on Linux, Sysmon on Windows) on all SAP hosts to capture parent-child process relationships. Correlate with SAP security audit log (SM20) for concurrent authentication anomalies on the same host.

These rules detect exploitation of CVE-2026-44756 OVERPASS via the most observable artifact: unexpected shell or network utility spawning from SAP kernel processes. Both carry experimental status; validate against your environment's audit logging configuration before enabling automatic blocking.

A single kernel patch closes all three OVERPASS exploitation routes. Patching internet-facing systems first reduces immediate exposure while internal instances are queued for the next maintenance window. SAP authorizations and Segregation of Duties controls provide no protection against pre-authentication flaws.

See also our coverage of the Cisco FMC CVE-2026-20079 pre-auth root RCE patch for a comparable playbook on emergency patching of perimeter infrastructure under active threat pressure.