Skip to content
Critical OVERPASS Vulnerability in SAP Kernel Requires Immediate Action

Critical OVERPASS Vulnerability in SAP Kernel Requires Immediate Action

First seen 8 Sep 2026, 16:43 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •September 9, 2026 at 16:16 UTC
  • •CVE-2026-44756 (OVERPASS) allows remote command execution without authentication.
  • •Over 10,000 Internet-facing SAP systems are potentially vulnerable to this flaw.
  • •SAP recommends immediate patching to prevent exploitation of critical vulnerabilities.

On September 8, 2026, SAP released security updates addressing 20 vulnerabilities, including a critical memory corruption flaw tracked as CVE-2026-44756, named OVERPASS. This vulnerability allows unauthenticated attackers to execute arbitrary commands on vulnerable SAP systems, leading to full compromise of business data. The flaw affects various SAP components using the Extended Passport (EPP) processing protocol, which is widely implemented across multiple SAP applications. Onapsis estimates over 10,000 Internet-facing SAP systems are potentially exposed to this risk. SAP has not reported any known active exploitation of this vulnerability as of the publication date. Immediate patching is recommended as the vulnerability is reachable through multiple vectors, including web requests and SAP GUI connections. The security updates also address other critical vulnerabilities, including CVE-2026-58240, which involves missing authentication checks in SAP NetWeaver. Organizations are urged to prioritize applying the patches to mitigate risks.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 44d ago How this analysis works

Timeline

2020-07-14
CVE-2020-6287 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2025-04-24
CVE-2025-31324 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-04-10
CVE-2026-34477 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-04-14
CVE-2026-2332 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-08-11
CVE-2026-58231 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-08-11
CVE-2026-58243 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-09-08
SAP releases September 2026 security updates
SAP published 20 new security notes, including critical patches for vulnerabilities like OVERPASS.
Securityweek
2026-09-08
CVE-2026-44756 disclosed
The OVERPASS vulnerability allows unauthenticated remote command execution on SAP systems.
Onapsis
2026-09-08
Onapsis warns of OVERPASS vulnerability
Onapsis identifies OVERPASS as a critical flaw affecting numerous SAP components, urging immediate action.
Bleepingcomputer
2026-09-08
CVE-2026-66767 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE

More articles in this cluster (24)

Following this threat?

Track Onapsis and CVE-2026-44756 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (20)

1 / 3