Summary
SAP issued an urgent security update this week to address the critical vulnerability CVE-2026-44756, commonly known as OVERPASS. The vulnerability has the highest possible severity rating, with a CVSS score of 10.0, and affects a wide range of SAP solutions.
OVERPASS could enable threat actors to disrupt SAP services, access sensitive information, change system data, or assume control of SAP servers through specific requests that trigger a buffer overflow in the SAP Kernel’s processing of Extended Passport (EPP) data.
The vulnerability is addressed by SAP Security Note 3747649. Organizations should immediately identify affected SAP systems, apply the required updates, restrict unnecessary network access, and monitor for signs of attempted exploitation.
Key Points
- OVERPASS is a critical SAP vulnerability with a CVSS score of 10.0.
- Attackers do not require valid SAP accounts to exploit the vulnerability.
- The vulnerability affects the SAP Kernel and therefore impacts several SAP services and components, including the Internet Communication Manager (ICM), RFC communications, SAP GUI, and SAP Web Dispatcher.
- Internet-facing systems are at the greatest immediate risk, but internal SAP systems may also be exposed.
- Applying SAP Security Note 3747649 is the recommended remediation.
- Network restrictions, monitoring controls, and security hardening can reduce risk while patches are being tested and deployed.
- Organizations should assess the entire SAP landscape, including production, development, test, disaster recovery, and standalone Web Dispatcher systems.
Background
OVERPASS is a security vulnerability in the SAP Kernel, which provides core functions used by many SAP applications and services.
The root cause of the vulnerability is a buffer overflow in the SAP Kernel’s deserializing or processing of Extended Passport (EPP) data. The Extended Passport is a tracing structure attached to SAP communications that tracks requests across connected systems. Attackers can send deliberately malformed requests that trigger a buffer overflow and write operations outside allocated memory areas. This corrupts the memory of SAP processes, enabling attackers to execute arbitrary operating-system commands with administrative privileges.
The requests are processed by the Kernel before the sender is authenticated. Consequently, attackers do not require valid SAP credentials to exploit OVERPASS. Standard protections such as SAP authentication and authorization controls therefore do not prevent successful exploitation.
Impact
Successful exploitation could allow attackers to run operating system commands using the credentials of SAP service accounts.
This could provide threat actors with significant control over SAP servers and applications. Potential consequences include:
- Access to sensitive business information
- Theft of credentials or security configuration data
- Unauthorized changes to SAP data or settings
- Disruption of business-critical SAP applications
- Installation of malicious software or unauthorized tools
- Creation of persistent access to the SAP environment
- Movement from one SAP system to other connected systems
- Compromise of trusted RFC connections and technical interfaces
Scope
Since Extended Passport requests are processed by the SAP Kernel, OVERPASS impacts communication channels and protocols that are served by the Kernel. This includes HTTP/HTTPS through the Internet Communication Manager (ICM) or Web Dispatcher, SAP GUI through the SAP Dispatcher, and Remote Function Call (RFC) communications between systems.
The ICM manages web-based communication for SAP applications. It supports services such as SAP Fiori, WebGUI, web services, APIs, and other HTTP or HTTPS connections.
The Web Dispatcher is often used as a reverse proxy to filter Web-based traffic to SAP solutions. It includes the ICM and SAP Kernel networking code.
SAP application servers accept connections from SAP GUI clients. Systems that are not accessible from the Internet may still be reachable from employee networks, administrative networks, remote-access services, partner connections, or unmanaged devices. A compromised internal device could therefore be used to target a vulnerable SAP system.
RFC connections allow SAP systems and external applications to exchange information and run functions remotely. RFC connections often link production systems with development systems, middleware, reporting tools, third-party applications, and other SAP environments. Such connections increase the potential reach of an attacker after an initial system is compromised.
Although Internet-facing systems require the most urgent attention, internal SAP systems should not be considered safe based only on their network location.
An attacker may reach an internal SAP system through a compromised user device, VPN connection, partner network, administrative workstation, integration server, or another SAP system. Development and test environments can also provide indirect paths into production.
Non-production systems may contain copies of production data, technical credentials, trusted RFC connections, or configuration information that could help an attacker move deeper into the SAP landscape.
Organizations should therefore assess systems based on their software versions, enabled services, connections, and network reachability rather than simply classifying them as external or internal.
Remediation
OVERPASS affects multiple SAP Kernel release lines including older 7.x kernel versions and newer 8.x and 9.x versions. For the Web Dispatcher, it impacts versions 9.16, 9.18, 9.19 and 9.20.
The relevant support package patches for each release should be applied to address the vulnerability. The patches for each release are detailed in note 3747649. The Kernels should be updated to the required patch level specified in the note. The corrections will enable SAP Kernels to validate externally supplied input in Extended Passport requests before processing, preventing memory corruption and therefore exploitation of the vulnerability.
Where practical, organizations should:
- Restrict access to impacted SAP ports and services using network access control lists
- Remove unnecessary Internet-facing services
- Limit SAP GUI access to managed user networks
- Require administrators to connect through controlled jump hosts
- Separate SAP servers from general employee networks
- Restrict RFC services to known systems and integration points
- Review firewall rules for outdated or overly broad access
- Block direct access to SAP application servers when traffic should pass through an application gateway or another controlled entry point
Security teams should also monitor the SAP application, Web Dispatcher, operating system, and network layers for possible signs of exploitation.
Relevant warning signs may include:
- Unexpected SAP process terminations or restarts
- Unusual requests sent to SAP web services
- Connections from unknown or unapproved IP addresses
- Unexpected operating system commands started by SAP service accounts
- New files or executables appearing on SAP servers
- Unusual RFC calls or connections
- Changes to SAP profiles, services, or configuration files
- Abnormal activity involving privileged technical users
- Unexpected outbound connections from SAP hosts
- Repeated failures involving SAP ICM or Web Dispatcher services
Monitoring should continue after patching to help identify any activity that may have occurred before the correction was applied.
Cybersecurity Extension for SAP
The Cybersecurity Extension for SAP enables organizations to identify, manage, and monitor exposure to OVERPASS through:
- Automatic detection of impacted SAP systems and components
- Identification of vulnerable SAP Kernel and Web Dispatcher versions and patch levels
- Tracking for the implementation status of SAP Security Note 3747649
- Prioritization of vulnerable systems based on business importance and exposure
- Virtual patch guidance when the SAP Kernel patches cannot be applied or implemented swiftly
- Network controls that restrict access to SAP ICM, Web Dispatcher, SAP Dispatcher, and RFC services
- Monitoring controls for suspicious activity involving affected SAP communication channels
- Security hardening for SAP ICM and Web Dispatcher services
- Review of exposed web services, administrative interfaces, access-control rules, and logging settings
- Hardening of RFC connections, RFC destinations, gateway controls, and trusted relationships
- Detection of suspicious operating system command execution at the SAP application and host level
- Monitoring of SAP logs, Web Dispatcher logs, operating system logs, and security events
- Detection of unusual RFC activity and connections from unapproved sources
- Integration of relevant alerts with SIEM platforms such as Sentinel, Splunk, and QRadar
- Centralized investigation, documentation, ownership, and tracking of remediation activities
- Continued monitoring during patch testing, deployment, and post-remediation validation
Conclusion
OVERPASS demonstrates why SAP security must cover more than user accounts and authorizations. A vulnerability in the SAP Kernel can affect several communication channels and may be reached before normal authentication and authorization checks occur.
Organizations should apply a coordinated security approach that includes vulnerability detection, patch management, network restrictions, secure configuration, system monitoring, and threat detection at the application and host level.
It is also important to monitor the complete SAP technology stack. An attack may begin with a request to an SAP service but lead to operating system commands running on the underlying host. Monitoring only SAP activity may not provide sufficient visibility to detect and investigate potential attacks.
Frequently Asked Questions
What is SAP OVERPASS?
OVERPASS is the commonly used name for CVE-2026-44756, a critical vulnerability affecting Extended Passport processing in the SAP Kernel.
How serious is the vulnerability?
CVE-2026-44756 has a CVSS score of 10.0, the highest possible severity rating. Organizations should treat it as an urgent patching and risk-reduction priority.
Does an attacker need an SAP account?
No. The vulnerability may be exploited without a valid SAP username or password.
Are systems safe if they are not connected to the Internet?
Not necessarily. Internal systems may still be reachable through SAP GUI connections, RFC communications, VPN access, partner connections, administrative networks, or compromised internal devices.
Can SAP roles and authorizations prevent an attack?
No. SAP roles and authorizations remain essential security controls, but they may not prevent exploitation because the vulnerable processing can occur before normal authentication and authorization checks.
Can a firewall completely protect the system?
Firewall rules and access control lists can reduce exposure by limiting which sources can reach SAP services. However, they do not correct the vulnerable SAP Kernel code. Applying SAP Security Note 3747649 remains the recommended remediation.
Should development and test systems be patched?
Yes. Non-production systems may contain sensitive data, technical credentials, trusted connections, and information about the production environment. They may also provide an attacker with a path to other systems.
How can organizations detect possible exploitation?
Organizations should monitor SAP and host-level activity for unexpected operating system commands, abnormal SAP process termination, suspicious network requests, unusual RFC communication, unauthorized configuration changes, and unexpected activity by SAP service accounts.
How does the Cybersecurity Extension for SAP help?
The Cybersecurity Extension for SAP automatically identifies vulnerable systems, supports virtual patch and network controls, assesses ICM, Web Dispatcher, and RFC security, detects suspicious operating system commands at the SAP and host levels, and tracks patching remediation across the SAP landscape.