OVERPASS CVE-2026-44756: Pre-Authentication SAP Kernel RCE Across Multiple Protocols

1. Basic Information

• Article Title: Mitigating OVERPASS (CVE-2026-44756): A Critical Vulnerability in the SAP Kernel
• Publisher: Onapsis
• Publication Date: 2026-09-08
• Original Source: Onapsis
• Related Sources: BleepingComputer: SAP warns of OVERPASS kernel vulnerability, SAP September 2026 Security Patch Day
• Related Malware, Groups, CVEs, and Products: CVE-2026-44756, SAP Kernel, SAP NetWeaver AS ABAP, SAP Web Dispatcher, SAP S/4HANA, SAP ERP
• Priority: Critical

2. Executive Summary

OVERPASS is a CVSS 10.0 buffer overflow in Extended Passport processing that permits pre-authentication OS command execution with SAP administrative privileges through HTTP(S), SAP GUI, or RFC.

3. Attack Flow

Successful exploitation path described by Onapsis; no in-the-wild exploitation observed

1. An attacker identifies an SAP component reachable over HTTP(S), SAP GUI, or RFC.
2. The attacker sends a crafted structure to EPP processing at session initiation.
3. A buffer overflow occurs in kernel code before authentication, roles, or logon policies are evaluated.
4. Arbitrary commands execute with the OS privileges of the SAP installation owner.
5. Inference: Code execution could enable theft of stored credentials and lateral movement to other SAP systems. Actual follow-on compromise has not been disclosed.

4. Attacker Position and Execution Environment

• An unauthenticated external attacker able to reach an internet-facing ICM or Web Dispatcher.
• An intruder inside the network able to reach SAP GUI or RFC services.

5. What Users and Administrators May See

Users

• Neither user interaction nor a valid SAP account is required.

Administrators

• Inference: SAP processes may crash or spawn suspicious child processes. A crash alone does not prove code execution.

6. Success Conditions and Risk Reduction

Success Conditions

• SAP Kernel is running without the fix from Security Note 3747649.
• The target process is reachable through HTTP(S), SAP GUI, or RFC.
• Application monitoring or network controls do not stop the crafted EPP input.

Failure Conditions and Risk Reduction

• Apply the kernel patch from SAP Security Note 3747649.
• Prioritize internet-facing systems, then patch internal systems reachable through SAP GUI or RFC as part of the same vulnerable scope.
• Until patching is complete, restrict connection sources using SAProuter, jump hosts, and Web Dispatcher, and monitor application-layer anomalies.

7. Potential Impact

• OS command execution with SAP administrative privileges and full system compromise.
• Theft of database credentials, password hashes, active sessions, and business data.
• Financial-record manipulation, fraud, ransomware, and lateral movement to connected SAP systems.

8. Observable Logs

Inference: These are investigation sources and their collection requirements.

• Email: Where relevant emails exist, preserve the original messages, complete URLs, and delivery records.
• Proxy/SWG/DNS: For HTTP paths, review available reverse-proxy and WAF logs. Investigate SAP GUI and RFC paths separately.
• Endpoint/EDR: Check SAP process crashes, suspicious child processes, and file operations by the SAP-owning OS user. EPP contents may not be recorded, depending on logging configuration.
• Identity/IdP: Check related accounts for suspicious authentication and session use. Assess successful authentication separately from data retrieval.
• SaaS/Cloud: For cloud deployments, review audit records for workloads, IAM, and API operations.
• Network: Check connection sources and timestamps for HTTP(S), SAP GUI, and RFC. Investigate business-data changes through SAP audit records.

9. Assessing Attack Success

The following are evidence criteria for an individual investigation. See Facts and Unknowns for the scope of actual observations.

• Attempt observed (success unconfirmed): Evidence criterion: Confirm crafted EPP input or abnormal requests to the affected service.
• User interaction confirmed: Evidence criterion: User interaction is not required.
• Initial execution confirmed: Evidence criterion: Confirm execution of suspicious commands or child processes originating from an SAP process. A crash alone is not successful code execution.
• Malware execution or authentication success confirmed: Evidence criterion: Confirm shell or process execution under the SAP owner account.
• Data theft or session compromise confirmed: Evidence criterion: Confirm unauthorized access to secure stores, databases, or session data.
• Follow-on compromise confirmed: Evidence criterion: Confirm RFC connections to other SAP systems, user creation, or data modification.

10. Investigation Playbook

Inference: Operational recommendations based on publicly described behavior.

• Trigger: Suspicious child processes of an SAP process, or related abnormal requests.
• Initial Checks: Identify the affected host, user, and time, and preserve relevant logs and configuration. For vulnerability incidents, verify the actual version and exposure.
• Endpoint: Check SAP process crashes, suspicious child processes, and file operations by the SAP-owning OS user. EPP contents may not be recorded, depending on logging configuration.
• Identity and Cloud: Check related accounts for suspicious authentication and session use. Assess successful authentication separately from data retrieval. For cloud deployments, review audit records for workloads, IAM, and API operations.
• Follow-on Activity: Check connection sources and timestamps for HTTP(S), SAP GUI, and RFC. Investigate business-data changes through SAP audit records.
• Containment: If suspicious execution is confirmed, restrict access to the affected SAP system and preserve audit and endpoint evidence. Alongside patching, investigate impacts on stored credentials and connected systems.
• Classification: These success criteria are for investigations. Distinguish evidence confirmed in the individual environment from publicly reported observations.

11. Defense and Detection Ideas

Inference: Operational recommendations based on publicly described behavior.

• Single Event: Suspicious child processes of an SAP process, or related abnormal requests.
• Time-Series Correlation: Correlate requests at the HTTP, SAP GUI, and RFC entry points with command execution or file operations on the same host.
• Threat Hunting: For HTTP paths, review available reverse-proxy and WAF logs. Investigate SAP GUI and RFC paths separately. Check connection sources and timestamps for HTTP(S), SAP GUI, and RFC. Investigate business-data changes through SAP audit records.
• Logging Gaps: Check retention periods and collection settings. DNS alone does not reveal URL paths, and ordinary network logs do not reveal endpoint-local activity. Missing records do not prove an absence of compromise.
• Priority Controls: Apply the kernel patch from SAP Security Note 3747649.

12. Facts / Inference / Hypothesis

Facts

• Onapsis named the buffer overflow in SAP Kernel Extended Passport (EPP) processing OVERPASS and rates it CVSS 10.0.
• EPP is processed at session initiation before authentication. Crafted input can arrive through at least three paths: HTTP(S) through ICM/Web Dispatcher, the SAP GUI Dispatcher, and RFC.
• Successful exploitation runs commands as the OS account that owns the SAP installation, providing access to secure stores, database credentials, session data, and business data.
• Onapsis conservatively identified more than 10,000 internet-facing SAP web interfaces, but had not observed in-the-wild exploitation at publication.
• A single kernel patch in SAP Security Note 3747649 fixes all paths. Network restrictions reduce exposure but do not replace patching.

Inference

• The investigation, detection, and mitigation recommendations are based on publicly described behavior. Their applicability depends on each environment’s collection settings, privileges, and traffic visibility.

Hypothesis

No additional hypotheses. Unresolved points are listed under Unknowns and Further Investigation.

13. MITRE ATT&CK Mapping

• T1190 Exploit Public-Facing Application (high confidence): The attacker targets pre-authentication RCE through an internet-facing SAP web layer.
• T1555 Credentials from Password Stores (high confidence): Credentials could be retrieved from SAP secure stores.
• T1021 Remote Services (medium confidence): Trust relationships such as RFC could be used to move to other SAP systems.

14. Unknowns and Further Investigation

• In-the-wild exploitation, exploit code, and stable network IOCs.
• Specific affected kernel builds and the exact reachable paths in each environment.
• Detailed triggering conditions that SAP has not made public.

15. Impact on SOCs and Organizations

Organizations using SAP should check kernel patch levels across the entire estate, including SAP GUI and RFC, rather than only internet-facing surfaces such as Fiori. Authentication, roles, and segregation of duties (SoD) are evaluated after this path and cannot substitute for remediation. Monitor and restrict access until patching is complete, and investigate secure stores and connected systems when anomalies appear.

16. Audience Summaries

• SOC: Correlate requests at the HTTP, SAP GUI, and RFC entry points with command execution or file operations on the same host.
• Administrators: Apply the kernel patch from SAP Security Note 3747649.
• Users: Neither user interaction nor a valid SAP account is required.