SAP issued Security Note 3747649 as part of its September 2026 Security Patch Day, resolving a maximum-severity vulnerability in the core SAP Kernel and Web Dispatcher components. Tracked as CVE-2026-44756 with a CVSS score of 10.0 and dubbed “OVERPASS” by Onapsis Research Labs, the issue is a buffer overflow within the Extended Passport Protocol (EPP) processing library. Because EPP metadata is parsed during the initial handshake before authentication, logon policies, or authorization objects are evaluated, an unauthenticated remote attacker can supply crafted payloads to trigger heap-based memory corruption and execute arbitrary code with host-level administrative privileges.

The vulnerability affects multiple kernel branches—including 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, and 9.16 through 9.20—and can be reached remotely via HTTP/HTTPS through the Internet Communication Manager (ICM), the DIAG protocol, or Remote Function Call (RFC) interfaces. Threat intelligence telemetry indicates that over 10,000 internet-facing SAP instances expose these vectors directly to the public internet. SAP has published updated kernel binaries and strongly urges immediate application, noting that a single kernel upgrade mitigates all protocol-level entry points.

Why it matters:

• Pre-authentication ERP compromise: Exploitation bypasses all application-layer authorization objects, network logon policies, and SAP role bindings, granting unauthenticated threat actors root or administrator execution directly on mission-critical ERP backbones.
• Enterprise perimeter defense priority: With more than 10,000 deployments exposed to external ingress, defenders must prioritize deploying SAP Security Note 3747649, restrict public access to ICM and RFC ports, and verify system integrity for persistent backdoors.