SAP Kernel RCE Vulnerability Hits 10,000+ Systems

A maximum-severity SAP kernel RCE vulnerability, tracked as CVE-2026-44756 and named OVERPASS by Onapsis Research Labs, lets an unauthenticated attacker reach shared SAP kernel code before any session authenticates — and it is reachable over three separate protocol paths at once. SAP patched the CVSS 10.0 flaw on September 8, 2026, as part of its September Patch Day. Onapsis identified more than 10,000 unique internet-facing IP addresses presenting an SAP web interface — this is not a confirmed count of vulnerable systems, and it does not capture internal SAP GUI or RFC exposure.

What Happened

This SAP kernel RCE vulnerability is a memory-corruption flaw in the Extended Passport (EPP) processing library — the tracing structure every SAP client attaches to a request at session open, originally built for cross-system transaction tracing. Because EPP is parsed before the session is authenticated, the vulnerable code executes before authentication has the opportunity to run. A remote, unauthenticated attacker can send a crafted request containing a malformed EPP header that corrupts memory. Onapsis assesses that successful exploitation can allow arbitrary operating-system command execution with SAP administrative privileges.

The defect lives in shared kernel code, not in a single application, so it can be reached through the web layer (HTTP/S), the classic SAP GUI layer, and the RFC layer — three separate access routes to the same vulnerable processing, not three separate vulnerabilities. Checking one exposed interface does not rule out the others. By component, the affected builds are: KRNL64NUC 7.22 and 7.22EXT; KRNL64UC 7.22, 7.22EXT, 7.53, and 8.04; WEBDISP 9.16, 9.18, 9.19, and 9.20; and KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.16, 9.18, 9.19, and 9.20 — not every version between 7.22 and 9.20, as a shorthand range would imply. SAP Security Note 3747649 remains the authoritative source for this list. Onapsis reported no observed in-the-wild exploitation as of its September 10 update. Germany’s BSI issued its own warning on September 9, 2026 (Kritikalität 2, Hoch) — one day after SAP’s disclosure.

Why It Matters

SAP is the operational backbone for a large share of DACH Mittelstand manufacturing, finance, and logistics operations, and this is the third CVSS-9.9-or-higher SAP kernel or application flaw disclosed in 2026 (following CVE-2026-0488 in SAP CRM/S/4HANA, covered here in February). A pre-auth flaw reachable over three separate protocol paths — not only the internet-facing web layer most perimeter monitoring watches — means the common “we only expose the Fiori launchpad” mitigation model does not fully close the gap; SAP GUI and RFC access from partner networks, VPNs, or misconfigured internal segments reach the same defect, and a WAF alone cannot fully mitigate this risk. The disclosure also lands in the same week the EU Cyber Resilience Act’s 24-hour active-exploitation reporting duty takes effect for manufacturers (September 11, 2026) — a reminder that patch cadence and incident reporting obligations are now moving on parallel, compressed clocks.

What You Should Do Now

1. Check your S/4HANA, ECC, NetWeaver, Web Dispatcher, BW/4HANA, Enterprise Portal, PI/PO or Solution Manager deployment against the specific affected builds — KRNL64NUC 7.22/7.22EXT; KRNL64UC 7.22/7.22EXT/7.53/8.04; WEBDISP 9.16/9.18/9.19/9.20; KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.16–9.20 — as listed in SAP Security Note 3747649, and treat patching as an emergency, not a routine cycle item. Do not assume every installation of these products is automatically affected just because it runs a kernel in this general numbering range.
2. Inventory every SAP GUI and RFC-reachable interface, not only the HTTP/S-facing ones; the EPP flaw is reachable via all three, so a WAF alone cannot fully mitigate this risk.
3. Increase monitoring for exploitation attempts and investigate anomalous requests against SAP Web Dispatcher and application servers, especially if immediate patching is not possible.
4. Confirm whether your SAP landscape includes internet-facing components at all — Onapsis’s count of 10,000+ internet-facing SAP web interfaces (not a confirmed vulnerable-system count) suggests many organizations may not have a complete inventory of which SAP interfaces are reachable from outside.

DIESEC Perspective

This is the pattern we keep seeing in Mittelstand SAP environments: a patch gets applied to the obviously internet-facing Fiori or web layer, while SAP GUI and RFC access from partner networks or older internal segments are assumed “not exposed” without ever being verified. A shared-kernel flaw like OVERPASS closes that assumption gap the hard way.

Not sure whether your SAP landscape has this gap? Contact DIESEC for a rapid SAP interface exposure and patch verification review.

Sources: Onapsis | BleepingComputer
Published: 2026-09-14 | Category: Vulnerabilities & Patches | ~4 min read