SAP Security Note 3747649 addresses CVE-2026-44756, a critical vulnerability known as OVERPASS, affecting SAP Extended Passport (EPP) Processing within the SAP kernel. Extended Passport is a tracing mechanism used by SAP applications and infrastructure components to track requests across distributed SAP landscapes. The vulnerability arises from insufficient boundary validation during the processing of EPP data, allowing an unauthenticated attacker to send a specially crafted network request that can trigger memory corruption within the SAP kernel. According to SAP and security researchers, successful exploitation may result in arbitrary operating system command execution with SAP administrative privileges, leading to complete compromise of affected SAP systems, including unauthorized access to business data, credentials, active user sessions, system configurations, and SAP executables. OVERPASS is particularly dangerous because the vulnerable code is executed during session establishment, before authentication and authorization controls are evaluated, rendering traditional SAP security controls such as user locks, roles, authorization objects, and logon policies ineffective against the attack.
SAP has assigned the vulnerability the maximum possible severity rating of CVSS 10.0 due to its remote, unauthenticated nature and the potential for full system compromise. The flaw affects a broad range of SAP products that rely on the vulnerable kernel code, including SAP S/4HANA, SAP ERP, SAP Business Suite, SAP NetWeaver AS ABAP, SAP NetWeaver AS Java, SAP BW/4HANA, SAP Enterprise Portal, SAP PI/PO, SAP Solution Manager, and SAP Web Dispatcher. The vulnerability can be reached through multiple communication channels, including HTTP(S), SAP GUI, and RFC connections, significantly increasing the potential attack surface.
SAP has released updated kernel and SAP Web Dispatcher patches that fully remediate the vulnerability and strongly recommends immediate implementation of the corrections provided in Security Note 3747649. Although a temporary workaround is available for certain HTTP(S)-based scenarios using SAP Web Dispatcher, neither SAP nor the reporting researchers consider it a complete mitigation because OVERPASS can also be exploited through SAP GUI and RFC communication paths. Organizations should therefore prioritize the deployment of the corrective patches, restrict access to SAP services from untrusted networks wherever possible, and closely monitor SAP systems for signs of abnormal kernel behavior, process crashes, or suspicious activity. Given its severity, broad impact, and potential for unauthenticated remote code execution, Security Note 3747649 should be treated as an emergency patching requirement for all affected SAP landscapes.
SAP Security Note 3759472 addresses a critical security vulnerability (CVSS 9.8) in the SAP NetWeaver Message Server that could allow an attacker with network access to connect an unauthorized server component to an SAP environment without authentication. Once connected, the attacker could potentially gain unauthorized access to system functions and impact the security and availability of the affected SAP landscape. SAP has corrected the issue by strengthening the verification process used when server components connect to the Message Server. Because the vulnerability can be exploited remotely, requires no authentication, and has no available workaround, SAP recommends that affected customers apply the required kernel patches as soon as possible and treat this note as a high-priority security update.
SAP Security Note 3798315 addresses a critical vulnerability (CVSS 9.4) in certain multi-tenant applications built with the SAP Cloud Application Programming Model (CAP). SAP identified a weakness that could allow an attacker to gain access to sensitive credentials used by affected applications and potentially use those credentials to modify, delete, or disrupt customer data. The issue affects CAP applications that use vulnerable versions of the @sap/cds-mtxs library and have extensibility features enabled. SAP has released updated versions of the affected software components and recommends that customers upgrade immediately and redeploy their applications. For customers running on SAP BTP Cloud Foundry, SAP has already taken additional steps to block the affected application endpoints until they are patched. Due to the potential impact on customer data and application availability, organizations using multitenant CAP applications should review this note promptly and apply the recommended updates as a high priority.
SAP Security Note 3781729 addresses a critical vulnerability (CVSS 9.0) in SAP GUI for Java that could allow a user with limited access to an SAP system to exploit a weakness in how trust settings are enforced. Under certain conditions, the vulnerability could be used to run unauthorized commands on a user’s workstation when interacting with an untrusted SAP system, potentially leading to compromise of the affected device and its data. SAP has released a patch that improves the way SAP GUI for Java validates trusted and untrusted systems before allowing certain actions. Because there is no workaround available, customers using SAP GUI for Java 8.10 should apply the recommended patch as soon as possible. For most organizations, the primary risk is to end-user workstations that connect to untrusted or potentially compromised SAP systems.