Reported by 6 outlets

Timeline

1. original reporting

   SAP warns of maximum severity 'OVERPASS' kernel vulnerability

   bleepingcomputer.com · 35d ago · September 8th, 2026

   SAP has addressed 20 vulnerabilities across multiple products in its September 2026 security updates, including a maximum-severity memory corruption flaw in the SAP Kernel code. Tracked as CVE-2026-44756 and dubbed OVERPASS by Onapsis security researchers who reported it, the vulnerability stems from a classic buffer overflow weakness in the Extended Passport Protocol (EPP) processing library. Successful exploitation lets unprivileged threat actors run arbitrary commands on vulnerable SAP hosts with administrative privileges, leading to full compromise of the underlying SAP processes and business data. The flaw can be exploited over SAP Internet Communication Manager (ICM), the networking component of the SAP Application Server that connects the SAP System (SAP NetWeaver Application Server) to the Internet via HTTP, HTTPS, and SMTP. According to Onapsis' estimates, more than 10,000 Internet-facing SAP systems use the vulnerable component and are potentially exposed to attacks exploiting the CVE-2026-44756 flaw. "A targeted search using high-fidelity fingerprints identifies more than 10,000 unique Internet-facing IP addresses presenting an SAP web interface reachable from the public Internet, and that figure is conservative," Onapsis CTO JP Perez-Etchegoyen said on Tuesday . "It counts only HTTP-reachable systems and materially undercounts the SAP Web Dispatcher, which proxies its backend and returns no distinguishing SAP banner on its root path, making it structurally hard fo

2. update from www.bleepingcomputer.com

   SAP warns of maximum severity 'OVERPASS' kernel vulnerability https:// bleepingcomputer.com/news/security/ sap-warns-of-maximum-severity-ove

   www.bleepingcomputer.com · 35d ago · September 8th, 2026

   SAP warns of maximum severity 'OVERPASS' kernel vulnerability https:// bleepingcomputer.com/news/security/ sap-warns-of-maximum-severity-ove

   via X https://www.bleepingcomputer.com/news/security/sap-warns-of-maximum-severity-overpass-kernel-vulnerability/

3. update from thecybersecguru.com

   🚨 SAP just patched a CVSS 10.0 nightmare. CVE-2026-44756 “OVERPASS” is a pre-auth SAP Kernel flaw that can take an unauthenticated attacker

   thecybersecguru.com · 34d ago · September 9th, 2026

   🚨 SAP just patched a CVSS 10.0 nightmare. CVE-2026-44756 “OVERPASS” is a pre-auth SAP Kernel flaw that can take an unauthenticated attacker

   via Mastodon https://thecybersecguru.com/news/sap-overpass-cve-2026-44756/

4. update from www.redhotcyber.com

   SAP OVERPASS: Critical RCE Vulnerability Exposes Enterprise Secrets, Commands, and Data

   www.redhotcyber.com · 33d ago · September 10th, 2026

   Segreti, comandi e dati aziendali per tutti a causa di una gravissima RCE 📌 Link all'articolo : https://www.

5. update from securityexpress.info

   The SAP OVERPASS vulnerability (CVE-2026-44756) scores a perfect CVSS 10.0, letting attackers seize SAP servers before login. Patch Note 374

   securityexpress.info · 33d ago · September 10th, 2026

   The SAP OVERPASS vulnerability (CVE-2026-44756) scores a perfect CVSS 10.0, letting attackers seize SAP servers before login. Patch Note 374

   via Mastodon https://securityexpress.info/sap-overpass-vulnerability/?utm_source=mastodon&utm_medium=jetpack_social

6. mentioned by diesec.com

   SAP patched (Sep 8) a CVSS 10.0 flaw reachable before login, via HTTP, SAP GUI, AND RFC. CVE-2026-44756 OVERPASS. 10,000+ SAP interfaces fou

   diesec.com · 29d ago · September 14th, 2026

7. update from deafnews.it

   SAP patched CVE-2026-58240, a pre-auth vulnerability in S/4HANA Message Server enabling unauthenticated RCE as sidadm. CVSS 9.8. Same port a

   deafnews.it · 26d ago · September 18th, 2026

   SAP patched CVE-2026-58240, a pre-auth vulnerability in S/4HANA Message Server enabling unauthenticated RCE as sidadm. Same port a

   via Mastodon https://deafnews.it/en/article/s4get-the-pre-auth-sap-s4hana-kernel-flaw-with-a-98-cvss