SAP Patches CVSS 10.0 Kernel Flaw Enabling Unauthenticated Remote Code Execution
Summary: SAP released security updates for multiple vulnerabilities, including CVE-2026-44756, a CVSS 10.0 memory corruption flaw in SAP Extended Passport (EPP) Processing that is remotely exploitable without authentication and allows arbitrary OS command execution with SAP administrative privileges. Discovered by Onapsis and codenamed OVERPASS, the flaw stems from missing boundary validation during deserialization of EPP data, and because EPP is shared kernel code it is reachable from the internet-facing web layer, the SAP GUI layer, and the RFC layer.
Key Takeaway: Onapsis CTO JP Perez-Etchegoyen states plainly that SAP authorizations and Segregation of Duties controls will not help, because the vulnerable code runs before any authentication step - so role tightening and password policies have no effect on this attack path.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-44756CVE-2026-58240
- Related
- ⚡ Weekly Recap: Rogue AI Agents, WeChat Worm, Paper Cut Attacks, AI Espionage, and Rootkits Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026