SAP OVERPASS: A CVSS-10 Kernel Flaw Owns Your SAP System Before the First Auth Check
A CVSS 10 hole in the SAP kernel lets an unauthenticated attacker own the system before the first authorization check ever runs. Patch Tuesday just moved from IT chore to board-level emergency.
SAP’s September security patch day landed on Tuesday (Sept 8) with 20 new and updated notes. One of them, CVE-2026-44756, carries the maximum CVSS score of 10. Onapsis, the application security firm that worked the flaw with SAP, gave it a name: OVERPASS. The name matters less than what the bug does.
OVERPASS is a memory corruption flaw in Extended Passport (EPP) processing, deep in the SAP kernel itself. Missing boundary validations during deserialization let externally supplied length fields trigger unsafe memory behavior. In plain terms: the data a client sends when opening a session is trusted before it is checked, and a crafted packet breaks that trust open.
Why a 10/10 here is different from a 10/10 elsewhere
Plenty of critical CVEs turn out to need exotic preconditions. This one doesn’t. An unauthenticated, remote attacker can:
- Run arbitrary operating system commands on the SAP host
- Recover database credentials and password hashes
- Read the live sessions of logged-in users
- Modify data, configuration, and even the SAP binaries themselves
Here is the part that should keep an SAP Basis team awake. EPP is processed as the session opens. Every control that decides who may do what, including user locks, roles, authorization objects, and logon policies, is evaluated after the point where the flaw is reached. As Onapsis put it: none of them is in the attacker’s way.
The attack surface is wide too. The bug can be reached over at least three vectors: web requests, the SAP GUI protocol, and Remote Function Call (RFC) connections. The vulnerable functionality ships enabled by default between ABAP systems. There is nothing to accidentally disable.
The affected components run under the OS account that owns the SAP installation. Compromise that account and you own the SAP system, down to the stored database passwords.
What runs on that kernel
If you need to check whether you are exposed, the affected product list reads like a census of African enterprise IT: S/4HANA, ERP, Business Suite (ECC), NetWeaver, Web Dispatcher, BW/4HANA, Enterprise Portal, PI/PO, and Solution Manager, among others.
Mining houses, utilities, retailers, and banks across the continent run their ledgers, payroll, and procurement on these systems. An SAP kernel is rarely internet-facing by design, but Web Dispatcher and RFC endpoints routinely poke through the perimeter, which is all an attacker needs.
The good news, for now: neither SAP nor Onapsis reports any signs of exploitation in the wild. That window will not stay open. A CVSS 10 with three reachable vectors in software this prevalent gets weaponized; the only variable is how fast you patch.
The rest of Tuesday’s notes
Three other critical fixes shipped in the same batch:
- CVE-2026-58240, dubbed S4GET, a missing authentication check that lets remote unauthenticated attackers register unauthorized components. It sits in SAP’s modern kernel and affects every S/4HANA 2025 and earlier release.
- CVE-2026-76969, a credential disclosure in multitenant applications built on the Cloud Application Programming Model (CAP).
- CVE-2026-66768, improper access control in NetWeaver.
Five more notes cover high-severity flaws in ABAP Developer Tools, Integration Suite, NetWeaver Business Client, NetWeaver, and Commerce Cloud search and navigation.
What to do this week
- Apply the September kernel patches to every SAP system, not just the ones with a public footprint. The kernel is shared across the products listed above.
- Inventory what actually reaches your SAP ports from the internet or from untrusted network segments. Web Dispatcher and RFC services are the usual culprits.
- Treat Solution Manager and PI/PO with extra care. They tend to sit between systems, hold credentials for everything they touch, and get patched last.
- Rotate any credentials stored on affected application servers once patching is done. If an attacker reached the kernel, assume the OS account’s secrets are burned.
Source: SecurityWeek’s reporting on SAP’s September 2026 security patch day, with technical detail from Onapsis research.
Enterprises running SAP across South Africa and the EU can’t afford to learn their patch status from an incident report. eHawu watches the layer beneath your core systems: every device on your endpoints and servers gets continuous vulnerability and exposure detection, with patch-status visibility that tells you which SAP hosts are still running the vulnerable kernel before an attacker does. eSub keeps your fleet patched and hardened automatically, and eHawuAV’s zero-trust posture engine stops untrusted sessions at the perimeter instead of at the login prompt, which is where OVERPASS proves the login prompt is too late. Built for African enterprises, backed by EU-grade compliance for the European market. eHawu: Securing the African Digital Future, One Enterprise at a Time.
The Thursday security digest
One email a week. The week's threat analyses, CVE breakdowns and infrastructure notes from the eHawu SOC. No noise, no daily spam.
