SAP's September 2026 patch day: a CVSS 10.0 in the passport layer

Opening

SAP publishes its security notes on the second Tuesday of each month. The September 2026 release, published on 8 September, carried nineteen new security notes and one update. Four were rated critical and four high, with the remainder medium or low. The headline item is CVE-2026-44756, scored 10.0 under CVSS 3.1 and given the internal name OVERPASS.
Where SAP patches land is often a governance problem before it is a technical one. This month the technical problem is specific enough to name.

Technical context

CVE-2026-44756, OVERPASS

The flaw sits in Extended Passport (EPP) processing. Passport is part of SAP's kernel-level security infrastructure: it carries the identity and authorisation context that travels with a request. EPP extends that context. The vulnerability is a memory-corruption and deserialisation defect arising from missing bounds validation.
It affects the SAP kernel and the standalone Web Dispatcher across the 7.x and 9.x lines. An unauthenticated request carrying a specially crafted EPP header can push the component into undefined behaviour, including a crash. Onapsis, which discovered the issue, describes the worst case as arbitrary OS command execution in the context of the SAP administrator. That is a pre-authentication path to the layer that brokers trust for everything above it.

CVE-2026-58240, Message Server

Scored 9.8, this is a missing authorisation check in the SAP NetWeaver Message Server. The Message Server coordinates communication between application servers in an ABAP system, including load-balancing information about which server should handle what. A missing check on that interface means an unauthenticated request can reach functionality that should require a session and a role.

CVE-2026-76969, cross-tenant credentials

Scored 9.4, this affects SAP Cloud Application Programming (CAP) and concerns cross-tenant credential exposure. Multi-tenant deployments share infrastructure across customers, and the isolation between tenants is the security boundary. A defect there means one tenant's credentials may become reachable from another's context.

CVE-2026-66768, GUI for Java

Scored 9.0, an improper access-control issue in SAP GUI for Java. It is client-side, which changes the exposure model: the affected component runs on user workstations rather than in the data centre.

Explanation and walkthrough

Why the passport layer is the right place to look first

Most SAP hardening discussion focuses on the application layer: authorisation objects, RFC destinations, ICM handlers, gateway registrations. EPP sits below that. It processes the metadata that establishes who a request is before application-level authorisation is even consulted. When the component that composes identity context can be driven into memory corruption by an unauthenticated header, the compensating controls above it are not compensating for anything. They are making decisions on data an attacker influenced earlier in the pipeline.
The fix is therefore a kernel-level patch rather than a note with a configuration workaround. There is no parameter to disable EPP without breaking the request flow it exists to serve.

The patch cycle is the real exposure

SAP's patching arithmetic is different from a typical Linux or Windows environment. Applying a kernel patch to an ABAP system involves a maintenance window, a transport path through a development and quality landscape, regression testing against custom code, and often an implementation partner's schedule. A monthly release calendar assumes a capacity for monthly remediation that many SAP estates do not have.
That gap is a known, measurable risk. Two things follow. First, the notes that map to pre-authentication network-reachable flaws deserve to jump the queue regardless of the calendar. Second, Web Dispatcher and kernel vulnerabilities deserve separate tracking from application notes, because they sit in front of every business process rather than one module.

What the fixed versions do not tell you

SAP publishes fixed support package levels rather than individual version numbers. The note text is access-restricted to licensed customers, which means exposure assessment frequently depends on an organisation's ability to pull the note set and map it to its own patch level. Teams that cannot answer "which support package are we on for the kernel, for the Web Dispatcher, and for the Message Server" cannot complete this triage.

Defensive implications

• Treat pre-authentication kernel notes as emergency changes. CVE-2026-44756 requires no credentials and no user interaction. Waiting for the next scheduled SAP maintenance window is a decision to carry that exposure for a month or more.
• Inventory the Web Dispatcher separately. It is often deployed in the DMZ, terminating TLS in front of the ABAP stack, and is usually patched on a different cadence than the application servers.
• Check Message Server access control at the network layer as an interim control. If the interface is not reachable from untrusted networks, the missing authorisation check is harder to reach.
• For CAP multi-tenant deployments, assume credential exposure is a rotation event. Cross-tenant credential defects are resolved by patching and, where exposure is plausible, by rotating the affected credentials.
• Distinguish client-side from server-side findings in prioritisation. CVE-2026-66768 in SAP GUI for Java affects endpoints, and its blast radius is the user's session rather than the database.
• Build the patch-level inventory before the next patch day. The recurring failure mode is not the decision to defer; it is discovering during triage that nobody can state the current kernel patch level.

References

• SAP Security Patch Day, September 2026 (8 September 2026)
• SAP Security Note for CVE-2026-44756 (OVERPASS)
• SAP Security Note for CVE-2026-58240
• SAP Security Note for CVE-2026-76969
• SAP Security Note for CVE-2026-66768
• Onapsis research on Extended Passport processing