CERT24SAP warns of maximum-severity OVERPASS kernel vulnerabilityLoading data…
CERT24Threat Observatory
Period

SAP warns of maximum-severity OVERPASS kernel vulnerability

SAP addressed 20 vulnerabilities across multiple products in its September 2026 security updates, including a maximum-severity memory corruption flaw in SAP Kernel code. Tracked as CVE-2026-44756 and named OVERPASS by Onapsis researchers, the flaw results from a classic buffer overflow in the Extended Passport Protocol processing library. Successful exploitation can allow unprivileged attackers to run arbitrary commands with administrative privileges on vulnerable SAP hosts, leading to full compromise of the underlying SAP processes and business data.

← Back to intelligence

SAP warns of maximum-severity OVERPASS kernel vulnerability

SAP addressed 20 vulnerabilities across multiple products in its September 2026 security updates, including a maximum-severity memory corruption flaw in SAP Kernel code. Tracked as CVE-2026-44756 and named OVERPASS by Onapsis researchers, the flaw results from a classic buffer overflow in the Extended Passport Protocol processing library. Successful exploitation can allow unprivileged attackers to run arbitrary commands with administrative privileges on vulnerable SAP hosts, leading to full compromise of the underlying SAP processes and business data.