Why you should have patched last week — or today.

What CVE-2026-44756 is

The Extended Passport is SAP’s request-tracing payload — a small binary structure carried in the sap-passport header over HTTP, and through its equivalents in RFC, DIAG, and ngRFC.

The kernel function eppDeserialize parses that payload.

Three memory-safety bugs exist in that function. The most severe one writes an unbounded UTF-8-to-UTF-16 transcode into a 0x430-byte stack buffer, straight through the saved return address of the parser itself.

In simplified form:

No credentials are required. CVSS 10.0 — network-accessible, no authentication, no user interaction, and high impact across confidentiality, integrity, and availability.

Where the risk lives

• HTTP on ICM / Web Dispatcher
• RFC on the Gateway, typically port 33xx
• DIAG on the Dispatcher, typically port 32xx
• ngRFC on the TLS-wrapped RFC port

Our research demonstrated arbitrary command execution through the DIAG path.

Work processes fork from the Dispatcher without execve, meaning base addresses remain stable per instance. Three per-target reconnaissance values are enough to feed a COP chain into system(<cmd>).

Traditional monitoring that only watches ABAP, SM49, or SUIM sees nothing.

Fixed patch levels

According to SAP’s own support-note list, the relevant fixed patch levels are:

From publication to working exploit — days, not months

We want to be direct here, because CVSS scores get discounted in triage more often than they should.

OVERPASS is also the second major SAP vulnerability we have looked at this week where the window between disclosure and a working exploit proved remarkably short. With CVE-2026-58240, our Research Lab went from SAP Patch Day to a working PoC in 96 hours. The pattern is increasingly difficult to ignore: SAP security teams should plan for days, not months, between disclosure and working exploit tooling.

For OVERPASS, building on the information that was available, a two-person team took the exploit from paper to proof in a handful of focused hours:

• Same afternoon: Pre-authentication detection working through kernel patch-level cross-referencing and an ICM endpoint check.
• Next day: HTTP denial of service — one crafted request, one ICM worker dead, SAP restart cycles.
• Day three: End-to-end DIAG RCE, including OS execution on the target as the reconnaissance step. system("id > /tmp/proof.txt") returned uid=1003(s4hadm).
• Day five: Cold-remote DIAG RCE against one specific build. A five-line change — jumping two bytes into do_system instead of __libc_system‘s public entry point, thereby skipping one push — resolved the alignment issue and delivered full command execution.

What SecurityBridge covers today

Patch Management

SecurityBridge Patch Management already detects missing SAP Security Notes, cross-references relevant SAP Security Notes, and flags CVE-2026-44756 as CRITICAL on systems below the required fix patch levels.

The dashboard shows which system is affected, which instance is involved, and which Note needs to be applied.

Post-exploitation Threat Detection

The phase after the exploit lands is already covered by SecurityBridge Threat Detection, including activity such as:

• RFC destination abuse and lateral movement across the trust graph
• Mass user creation
• SAP_ALL grants
• DDIC / SAP* activation
• Downloading critical tables

What to do this week

1. Apply the kernel patch (SAP Note 3747649). Kernels past end-of-life need a Downward Compatible Kernel (DCK) upgrade first. Prioritize Internet-facing ICM / Dispatcher systems, then Gateway-exposed instances.
2. Patch Web Dispatcher 9.16 separately where you run it standalone. Use SAPWEBDISP.SAR and refer to SAP Note 908097. Embedded Web Dispatchers pick up the fix as part of the kernel patch.
3. If patching has to wait, apply the temporary workaround (SAP Note 3756304). But understand what it covers. It only filters HTTP(S) traffic that transits a properly patched Web Dispatcher.

4. Tighten the network layer:
   
   • Block WebSocket-upgrade requests targeting the RFC endpoint on every ICM / WDP port — even where the SAP switch that normally denies them is turned off.
   • Restrict RFC-family ports 32xx (DIAG), 33xx (Gateway), and 36xx (Message Server) to trusted admin / application-server subnets.
5. Update the SAP Host Agent to a current patch level.

SAP’s FAQ for the fix is SAP Note 3776034 — a useful source for edge cases including dual-stack systems, embedded versus standalone Web Dispatcher deployments, and the timing of the SP Stack Kernel versus the hotfix.

Bottom line

OVERPASS is a rare “everything lines up” SAP kernel bug: pre-authentication, four channels, ten affected kernel lines, and a published research base that turns months of exploit work into a long weekend.

If SecurityBridge Patch Management shows any system as red for CVE-2026-44756, patch immediately.

References

• SAP Security Note 3747649 — CVE-2026-44756 kernel patch
• SAP Security Note 3776034 — FAQ for Note 3747649
• SAP Security Note 3756304 — Web Dispatcher HTTP-only interim workaround
• SAP Note 908097 — Standalone Web Dispatcher via SAPWEBDISP.SAR