The vulnerability, tracked as CVE-2026-44756 and dubbed OVERPASS, is a critical memory corruption flaw in SAP's Extended Passport Processing component of the kernel. It results from missing boundary checks during deserialization of externally supplied length fields, causing unsafe memory operations. This flaw allows unauthenticated remote attackers to run arbitrary system commands, recover database credentials and password hashes, read live user sessions, and modify SAP data and binaries. The vulnerability affects numerous SAP products that use the kernel, including S/4HANA, ERP, Business Suite (ECC), NetWeaver, and others. It can be exploited through at least three vectors: web requests, SAP GUI protocol, and Remote Function Call (RFC) connections. Because the vulnerable code runs under the operating system account owning the SAP installation, successful exploitation grants full control over the SAP system. The flaw is triggered as soon as a new user session is opened, before any authorization checks are performed, effectively bypassing all access controls. SAP has released security notes and patches to address this critical issue. No evidence of exploitation in the wild has been reported.

Successful exploitation allows unauthenticated remote attackers to execute arbitrary commands on the SAP system, recover sensitive secrets such as database credentials and password hashes, read live sessions of logged-in users, and modify critical data including configurations and SAP binaries. This effectively grants attackers full control over the affected SAP system, posing a severe risk to confidentiality, integrity, and availability.

SAP has released official security patches addressing this critical vulnerability. Applying these patches promptly is the primary recommended mitigation. There are no indications that the vulnerability has been exploited in the wild. Organizations should review SAP's September 2026 security notes and apply the relevant updates to affected SAP products to remediate the issue.