SAP's September 2026 patch cycle fixes CVE-2026-44756, rated CVSS 10.0, found by Onapsis and named OVERPASS.

It is a memory corruption flaw in the SAP kernel's handling of Extended Passport, the header SAP uses to trace a request across systems for diagnostics and performance monitoring. Boundary validation is missing during deserialization of EPP data, so an externally supplied length field produces a memory safety violation.

The attack is a network request carrying a malformed EPP header. That is the whole precondition.

The sentence that should stop an SAP team

From Onapsis:

SAP authorizations and Segregation of Duties controls will not help. The vulnerable code runs before any authentication step.

Consider what that removes.

Segregation of Duties is the centre of SAP security. It is what the authorization design exists to enforce, what external auditors test every year, what a GRC deployment costs, and what most SAP security work in a large organisation actually consists of. Roles, derived roles, critical combinations, the whole apparatus.

None of it is in the path here. The vulnerable code executes before SAP has any idea who is talking to it, which means every control built on the answer to "who is this and what may they do" is downstream of the problem and cannot see it.

That is not a criticism of SoD, which does the job it was designed for. It is a warning about assuming your investment covers a class of risk it was never aimed at. An SAP estate can be immaculately governed and still fall to a header.

The attack surface is a diagnostic feature

Extended Passport exists so that operators can follow a transaction across an SAP landscape and work out where time went. It is observability.

Which puts it in familiar company. The Telerik chain last week ran through a file upload control's convenience path, and the VMware escapes ran through the paravirtualised network adapter and the shared-folders implementation. The pattern is consistent enough to plan around: the code most likely to be reachable before authentication, and least likely to have been reviewed as security-relevant, is the code somebody added to make operations easier.

Nobody threat-models the tracing header.

The rest of the cycle

The same release carries CVE-2026-58240 in S4GET at CVSS 9.8, CVE-2026-76969 at 9.4, and CVE-2026-66768 at 9.0.

That is four flaws at 9.0 or above in one month, which for SAP is a heavy cycle by any standard, and OVERPASS is the one with no authentication in front of it.

None of them has been exploited to date.

What to do

  • Apply the September SAP Security Notes, prioritising the kernel update for CVE-2026-44756.
  • Do not let the SoD conversation absorb this. The people who own authorization design are not the people who can fix it; the ones who patch the kernel are.
  • Restrict who can reach SAP application servers on the network. With authentication out of the picture, reachability is the only remaining control.
  • Check what is exposed beyond the obvious. SAP kernel code is shared across components and protocols, so the surface is wider than the interfaces you think of as public.
  • Ask your SAP partner for the specific version mapping. The advisory describes the flaw as kernel-level without naming affected releases in the reporting, and your basis team needs the exact numbers.

What is not established

  • Which SAP product versions and kernel releases are affected. Not specified in the reporting.
  • Whether it has been exploited. None to date.
  • Whether a proof of concept exists outside Onapsis.
  • How the flaw interacts with SAP Cloud deployments.