SAP Patches Critical Extended Passport Processing Vulnerability
SAP released 20 new and updated security notes, including patches for a critical CVSS 10/10 memory corruption vulnerability (CVE-2026-44756, dubbed OVERPASS) in Extended Passport (EPP) Processing The OVERPASS flaw allows unauthenticated attackers to execute arbitrary commands, steal credentials, read live sessions, and modify data because EPP is processed before any authorization checks during session initialization Three additional critical vulnerabilities were patched: CVE-2026-58240 (S4GET —
Analysis
TL;DR
- SAP released 20 new and updated security notes, including patches for a critical CVSS 10/10 memory corruption vulnerability (CVE-2026-44756, dubbed OVERPASS) in Extended Passport (EPP) Processing
- The OVERPASS flaw allows unauthenticated attackers to execute arbitrary commands, steal credentials, read live sessions, and modify data because EPP is processed before any authorization checks during session initialization
- Three additional critical vulnerabilities were patched: CVE-2026-58240 (S4GET — missing authentication in NetWeaver), CVE-2026-76969 (credential disclosure in CAP multitenant apps), and CVE-2026-66768 (improper access control in NetWeaver)
- The vulnerability affects a wide range of SAP products including S/4HANA, ERP, ECC, NetWeaver, BW/4HANA, and others, but no in-the-wild exploitation has been detected
- Five high-severity flaws were also addressed across ABAP Developer Tools, Integration Suite, NetWeaver Business Client, NetWeaver, and Commerce Cloud
Why It Matters
This is a significant enterprise security event affecting one of the world's most widely deployed ERP platforms, with vulnerabilities that bypass all authentication and authorization controls at the kernel level. For AI practitioners and security professionals, it underscores the critical importance of supply chain security and the risks inherent in processing untrusted input before access controls are evaluated — a pattern that can appear in any AI infrastructure relying on enterprise middleware.
Technical Details
- CVE-2026-44756 (OVERPASS): A memory corruption vulnerability in the SAP kernel's Extended Passport (EPP) Processing module caused by missing boundary validations during deserialization of EPP data, specifically when processing externally supplied length fields. The flaw is triggered at session open time — before any user locks, roles, authorization objects, or logon policies are evaluated — making it fully unauthenticated.
- Exploitation vectors: The vulnerability is reachable via at least three protocols: web requests, SAP GUI protocol, and Remote Function Call (RFC) connections. Successful exploitation grants code execution under the OS account owning the SAP installation, equivalent to full system compromise.
- CVE-2026-58240 (S4GET): A missing authentication check in SAP's modern kernel affecting all S/4HANA 2025 and earlier releases, allowing remote unauthenticated attackers to register unauthorized components and perform actions without authorization.
- Other critical flaws: CVE-2026-76969 involves credential disclosure in multitenant applications using the Cloud Application Programming Model (CAP), while CVE-2026-66768 addresses improper access control in NetWeaver.
- Affected product scope: S/4HANA, ERP, Business Suite (ECC), NetWeaver, Web Dispatcher, BW/4HANA, Enterprise Portal, PI/PO, and Solution Manager. Five high-severity patches cover ABAP Developer Tools, Integration Suite, NetWeaver Business Client, NetWeaver, and Commerce Cloud (Search and Navigation).
Industry Insight
- Organizations running SAP environments should prioritize applying the September 2026 security patches immediately, especially for S/4HANA systems, given the unauthenticated remote code execution risk and the broad attack surface across multiple communication protocols.
- The OVERPASS vulnerability highlights a systemic architectural concern: when security-critical processing occurs before authentication and authorization checks, the entire access control model is bypassed. AI infrastructure teams should audit similar patterns in their own middleware and data pipeline components.
- With no current evidence of in-the-wild exploitation, this represents a proactive patching opportunity; however, the CVSS 10/10 rating and ease of exploitation (no authentication required, multiple vectors) make it likely to be weaponized quickly, so defensive monitoring and patch deployment should not be delayed.
Disclaimer: The above content is generated by AI and is for reference only.