A memory safety vulnerability exists in the Extended Passport Protocol

CVE-2026-44756 is a classic buffer overflow (CWE-120) in SAP's Extended Passport (EPP) processing library — the tracing mechanism embedded in every SAP ABAP/Java kernel and Web Dispatcher instance. EPP headers ride along with every HTTP and RFC request processed by the SAP Internet Communication Manager (ICM). A crafted network request with a malformed EPP header containing improper length fields triggers a memory safety violation during deserialization. Because ICM runs with SAP administrative (adm) privileges, successful exploitation yields arbitrary OS command execution at that privilege level. Affected versions span KRNL64NUC 7.22, KRNL64UC 7.22–8.04, KERNEL 7.22–9.20, and WEBDISP 9.16–9.20 — essentially every supported SAP kernel release in the field. The patch ships as SAP Note #3747649.

The vendor CVSS of 10.0 is fully justified. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects the reality: no authentication, no user interaction, low complexity, scope-change to the underlying OS, and full CIA impact. EPP parsing is enabled by default and reachable through multiple protocols — HTTP via ICF, RFC, and Web Dispatcher reverse-proxy paths. There is no single network-layer chokepoint that eliminates exposure without also breaking SAP functionality. Onapsis Research Labs, who discovered the flaw, explicitly confirm it 'allows remote attackers to run arbitrary operating system commands on the SAP host with SAP administrative privileges, resulting in full compromise of the underlying SAP business data and processes.' This is not a theoretical 10 — it is a practical 10.

Why this verdict

• Pre-auth network attack surface: The EPP header is parsed before any authentication check. Any TCP connection to an SAP HTTP, RFC, or Web Dispatcher port reaches the vulnerable code path. This eliminates the most common friction point (authentication) entirely.
• Default-on across all SAP kernels: EPP processing is compiled into the SAP kernel and cannot be disabled without breaking distributed tracing. Every ABAP, Java, and Web Dispatcher instance is affected — there is no 'optional feature' friction.
• Role multiplier: SAP systems are canonical high-value-role components. They host ERP, financials (FI/CO), HR/payroll, supply chain (MM/SD), and manufacturing (PP). A compromised SAP host yields access to the enterprise's crown-jewel business data. ≥90% of SAP kernel installations are production business-critical systems by definition. The blast radius is enterprise-data-scale, and in landscapes with RFC trust relationships, it chains to fleet-scale SAP compromise. This sets the verdict floor at CRITICAL.
• Scope change confirmed: The CVSS Scope:Changed metric is accurate — exploitation breaks out of the SAP application boundary to the underlying OS. The <sid>adm user typically has database access, SSH trust to peer SAP hosts, and transport directory write access.
• No compensating single control: Unlike vulns behind a WAF rule or authentication gate, there is no single network control that blocks EPP headers without also breaking SAP functionality. Firewall restrictions help but don't eliminate internal exposure.

Why not higher?

This is already the maximum severity (CRITICAL / 10.0). There is no higher bucket.

Why not lower?

Downgrading requires identifying friction that narrows the reachable population or raises attack complexity. Here: (1) no authentication required, (2) low attack complexity, (3) default-on in every SAP kernel, (4) reachable over multiple protocols, (5) the affected component is canonically a high-value production system hosting regulated business data. The only friction is the absence of a public PoC and the need for binary exploitation skill — but CWE-120 buffer overflows in network parsers are among the best-understood exploit primitives. This does not justify any downgrade from the vendor's 10.0.

1. Restrict network access to SAP HTTP/RFC/Web Dispatcher ports — Immediately tighten firewall rules so that only known, trusted IP ranges (application front-ends, integration middleware, admin jump hosts) can reach SAP ICM ports (8000–8099, 44300, 3200–3399). This is the noisgate mitigation SLA action — deploy within 3 days. It does not eliminate the vulnerability but drastically reduces the attacker population that can reach it.
2. Remove SAP systems from direct internet exposure — If SAP Web Dispatcher or Fiori front-end servers are internet-facing, place them behind a WAF or reverse proxy that can inspect and drop requests with oversized SAP-PASSPORT HTTP headers. Block direct internet→SAP ICM connectivity. Deploy within 3 days.
3. Enable SAP ICM request logging and crash monitoring — Configure ICM trace level to capture request headers (icm/HTTP/logging_* parameters). Set up SIEM alerts on ICM process crashes (segfaults in dev_icm logs) as an early-warning indicator of exploitation attempts. Deploy within 3 days.
4. Apply SAP Note #3747649 — This is the definitive fix. The kernel patch requires an SAP system restart. Schedule emergency downtime per your CAB process. Under the noisgate remediation SLA, apply within 90 days — but given the severity, target the next available maintenance window.
5. Harden the SAP OS layer — Ensure ASLR and DEP/NX are enabled on SAP application server OS (Linux: verify randomize_va_space=2; Windows: verify DEP policy). This raises the bar for reliable code execution from a crash. Not a fix, but buys time.

Run this script on each SAP application server as <sid>adm or root. It checks the SAP kernel patch level against the fixed version from SAP Note #3747649. Example: sudo -u <sid>adm bash check_cve_2026_44756.sh or simply bash check_cve_2026_44756.sh as root.

#!/usr/bin/env bash
# check_cve_2026_44756.sh — Detect CVE-2026-44756 exposure
# Run as <sid>adm or root on each SAP application server
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -euo pipefail

# Locate SAP kernel executable
DIR_EXECUTABLE=""
for d in /usr/sap/*/SYS/exe/uc/*/; do
  if [[ -x "${d}disp+work" ]]; then
    DIR_EXECUTABLE="$d"
    break
  fi
done

if [[ -z "$DIR_EXECUTABLE" ]]; then
  # Try run directory
  for d in /usr/sap/*/DVEBMGS*/exe/ /usr/sap/*/D*/exe/ /usr/sap/*/W*/exe/; do
    if [[ -x "${d}disp+work" ]] || [[ -x "${d}sapwebdisp" ]]; then
      DIR_EXECUTABLE="$d"
      break
    fi
  done
fi

if [[ -z "$DIR_EXECUTABLE" ]]; then
  echo "UNKNOWN — Could not locate SAP kernel executables. Verify SAP is installed on this host."
  exit 2
fi

# Get kernel patch level
KERNEL_INFO=""
if [[ -x "${DIR_EXECUTABLE}disp+work" ]]; then
  KERNEL_INFO=$("${DIR_EXECUTABLE}disp+work" -version 2>/dev/null || true)
elif [[ -x "${DIR_EXECUTABLE}sapwebdisp" ]]; then
  KERNEL_INFO=$("${DIR_EXECUTABLE}sapwebdisp" -version 2>/dev/null || true)
fi

if [[ -z "$KERNEL_INFO" ]]; then
  echo "UNKNOWN — Could not retrieve kernel version info."
  exit 2
fi

# Extract kernel release and patch number
KERNEL_RELEASE=$(echo "$KERNEL_INFO" | grep -i 'kernel release' | head -1 | awk '{print $NF}')
PATCH_NUMBER=$(echo "$KERNEL_INFO" | grep -i 'patch number' | head -1 | awk '{print $NF}')

if [[ -z "$KERNEL_RELEASE" ]] || [[ -z "$PATCH_NUMBER" ]]; then
  echo "UNKNOWN — Could not parse kernel release or patch number."
  echo "Raw output: $KERNEL_INFO"
  exit 2
fi

echo "Detected SAP Kernel Release: $KERNEL_RELEASE, Patch Number: $PATCH_NUMBER"
echo "CVE-2026-44756 affects KERNEL 7.22-9.20, all patch levels before SAP Note #3747649"
echo ""

# Check if kernel is in affected range
case "$KERNEL_RELEASE" in
  722|753|754|777|789|793|804|916|918|919|920)
    # These are affected releases — check if SAP Note 3747649 is applied
    # The note applies a kernel patch; the specific patch number threshold
    # varies by release. Check SAP Note #3747649 for your release's minimum patch level.
    echo "VULNERABLE — Kernel release $KERNEL_RELEASE is in the affected range."
    echo "Apply SAP Note #3747649 immediately. Verify the minimum patch level for release $KERNEL_RELEASE in the note."
    echo "Current patch: $PATCH_NUMBER"
    exit 1
    ;;
  *)
    echo "PATCHED — Kernel release $KERNEL_RELEASE is not in the known affected range (7.22-9.20)."
    exit 0
    ;;
esac

Sources

1. SAP Security Updates September 2026 — CybersecurityNews
2. September 2026 SAP Security Patch Day — SecurityOnline
3. Onapsis SAP Patch Day September 2026 Analysis
4. CVE-2026-44756 Threat Intelligence — OffSeq Radar
5. SAP Extended Passport (EPP) ABAP Documentation
6. GBHackers — SAP September 2026 Security Update
7. Tenable — CVE-2026-44756