CyberNew CyberNew
Vulnerabilities & CVEs BleepingComputer 1 month ago

SAP warns of maximum severity 'OVERPASS' kernel vulnerability

CN
CyberNew Threat Research Desk
• Original Reporting: BleepingComputer
CyberNew Threat Intel Assessment
Assessed Severity: HIGH
Impacted Surface
Enterprise Perimeter & Network Defense
Intelligence Sector
Vulnerabilities & CVEs

Analyst Takeaway

"SAP has addressed 20 vulnerabilities across multiple products in its September 2026 security updates , including a maximum-severity memory corruption flaw in the SAP Kernel code. Tracked as CVE-2026-44756 and dubbed OVERPASS by Onapsis security researchers who reported it, the vulnerability stems from a classic buffer overflow weakness in the Extended Passport Protocol (EPP) processing library...."

Recommended Defense & Mitigation

  • Access Review: Audit administrative roles, enforce phishing-resistant MFA, and review privilege escalations.
  • Credential Rotation: Rotate high-privilege service credentials and tokens associated with impacted services.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)

SAP

SAP has addressed 20 vulnerabilities across multiple products in its September 2026 security updates, including a maximum-severity memory corruption flaw in the SAP Kernel code.

Tracked as CVE-2026-44756 and dubbed OVERPASS by Onapsis security researchers who reported it, the vulnerability stems from a classic buffer overflow weakness in the Extended Passport Protocol (EPP) processing library.

Successful exploitation lets unprivileged threat actors run arbitrary commands on vulnerable SAP hosts with administrative privileges, leading to full compromise of the underlying SAP processes and business data.

Get the report

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from BleepingComputer.

Primary Advisory →