The SAP OVERPASS vulnerability, tracked as CVE-2026-44756, carries a CVSS score of 10.0, the highest possible. SAP released a fix on its 8 September 2026 Security Patch Day in Security Note 3747649. Onapsis Research Labs, which found the flaw, said it had seen no exploitation in the wild.
The flaw sits in code shared across SAP’s business software, so it reaches customers worldwide rather than any one market. CVSS, the Common Vulnerability Scoring System, is the industry’s 0-to-10 severity scale; 10.0 means an unauthenticated attacker reachable over the network can take full control.
What the OVERPASS Vulnerability Actually Does
OVERPASS is a memory corruption bug in how the SAP kernel handles the Extended Passport, or EPP, a header SAP systems attach to requests so administrators can trace a transaction end to end.
The kernel fails to validate boundaries when it deserialises EPP data, so a crafted request carrying a malformed EPP header with an oversized length field overruns memory. Because the EPP header is read as a session opens, the fault is reached before SAP’s authentication and authorisation checks run. That is what makes it unauthenticated.
Onapsis says a successful attacker can run arbitrary operating system commands on the SAP host under the SAP installation’s operating system account, recover database credentials and password hashes, read the sessions of logged-in users, and alter data, configurations and SAP binaries.
Which SAP Products Are Affected
The bug is in shared kernel code, which is why the product list is long. Onapsis lists the affected software as:
- SAP S/4HANA: the current-generation ERP suite.
- SAP ERP and SAP Business Suite (ECC): the older on-premises ERP lines.
- SAP NetWeaver Application Server ABAP: the application server underneath much of the estate.
- SAP Web Dispatcher: the software load balancer that fronts SAP web traffic.
- SAP BW/4HANA, SAP Enterprise Portal, SAP PI/PO and SAP Solution Manager: data warehousing, portal, integration and management components.
Published summaries do not agree on exactly which SAP Kernel and Web Dispatcher release levels are in scope. Some list kernel releases from 7.22 through 8.04 and Web Dispatcher 9.16 to 9.20; Onapsis’s own write-up names Web Dispatcher 9.16 and says other Web Dispatcher versions and HANA Extended Application Services are unaffected. Security Note 3747649 is the authoritative list, and Onapsis advises checking a system’s kernel release and patch level against that note first.
The Notes SAP Published on 8 September 2026
Onapsis Research Labs counted 22 security notes in the September release, five of them HotNews, SAP’s top severity band, and six of them High Priority. Six notes were new, three of those HotNews. The five HotNews notes:
| CVE | SAP Security Note | Component | CVSS |
|---|---|---|---|
| CVE-2026-44756 (OVERPASS) | 3747649 | SAP Extended Passport processing | 10.0 |
| CVE-2026-58231 | 3771065 | SAP Commerce Cloud (Data Hub Adapter) | 10.0 |
| CVE-2026-58240 (S4GET) | 3759472 | SAP NetWeaver Message Server | 9.8 |
| CVE-2026-76969 | 3798315 | SAP Cloud Application Programming Model | 9.4 |
| CVE-2026-66768 | 3781729 | SAP GUI for Java | 9.0 |
SAP publishes its patch day schedule and the notes themselves on its security notes page, which lists 8 September 2026 as the September patch day. Access to individual notes requires an SAP customer account.
Why the Vulnerability Counts in Coverage Disagree
Reports of this patch day carry different totals. Onapsis counted 22 notes; SecurityWeek reported 20 new and updated notes; other outlets published 19. The numbers describe different things: some count only newly issued notes, others include updates to existing notes, and some count distinct CVEs rather than notes.
For anyone deciding what to apply, the note numbers matter and the headline total does not. The table above lists the five that SAP classified HotNews.
What SAP Offers Short of Patching
SAP has published compensating controls for organisations that cannot patch immediately. Note 3756304 prevents exploitation over HTTP, and note 3776034 is a frequently asked questions document.
Onapsis is explicit that these are partial. The flaw is reachable over more than one path, including SAP GUI and RFC, SAP’s remote function call protocol, and it states that “a single kernel patch closes all exploitation vectors” while no individual control does. That distinction matters for change-control boards weighing an emergency kernel update against a maintenance window.
How Many Systems Are Exposed
Onapsis said a search using its own fingerprints identified more than 10,000 unique internet-facing IP addresses presenting an SAP web interface, and that these are potentially exposed. The path to the flaw runs through the SAP Internet Communication Manager, the component that connects SAP systems to HTTP, HTTPS and SMTP traffic.
That figure counts internet-facing web interfaces, not confirmed vulnerable systems, and Onapsis is the only organisation to have published it. Onapsis says a system should be treated as vulnerable if it runs NetWeaver kernel software, exposes a web tier to the internet, allows SAP Dispatcher access beyond a controlled client population, or holds a copy of production data.
What Happened the Last Time an SAP Flaw Sat Unpatched
The reason security teams treat SAP notes as urgent is recent. CVE-2025-31324, a 9.8-rated missing authorisation check in SAP NetWeaver Visual Composer disclosed on 24 April 2025, was already being exploited before disclosure. Rapid7 observed exploitation in customer environments dating to at least 27 March 2025, mostly at manufacturers.
ReliaQuest later attributed activity from that campaign to the ransomware groups BianLian and RansomEXX, and a separate incident-response account attributed pre-patch exploitation to Qilin. Those attributions come from the security firms that investigated and have not been confirmed by law enforcement.
As of 9 September 2026, Onapsis Research Labs stated in its remediation guidance that it “has not observed active in-the-wild exploitation” of OVERPASS. That is the position at the time of writing, not a forecast.
Frequently Asked Questions
What Is the SAP OVERPASS Vulnerability?
OVERPASS is CVE-2026-44756, a memory corruption flaw in the SAP kernel’s Extended Passport processing, rated CVSS 10.0. An unauthenticated remote attacker can run operating system commands on the SAP host. SAP fixed it in Security Note 3747649 on 8 September 2026.
Which SAP Security Note Fixes It?
Security Note 3747649, delivered as a kernel patch. Notes 3756304 and 3776034 provide a partial HTTP control and a FAQ, but Onapsis says only the kernel patch closes every exploitation path.
Has the SAP OVERPASS Vulnerability Been Exploited?
Onapsis Research Labs said it had not observed active exploitation in the wild as of 9 September 2026. That status can change, and it applies to what Onapsis has observed rather than to every system worldwide.
Does This Affect SAP Cloud Customers?
The kernel flaw affects SAP kernel and NetWeaver-based systems including S/4HANA, ECC, Web Dispatcher, BW/4HANA, Enterprise Portal, PI/PO and Solution Manager. A separate CVSS 10.0 note in the same release, 3771065, covers SAP Commerce Cloud. Which of these an organisation runs, and how, decides whether it is in scope.
How Many SAP Systems Are Exposed to the Internet?
Onapsis said it identified more than 10,000 internet-facing IP addresses presenting an SAP web interface. That count is of exposed interfaces, not confirmed vulnerable systems, and comes from Onapsis alone.
