SAP’s Rare Perfect 10: Inside the OVERPASS Kernel Flaw and What to Do Now

SAP has patched a SAP kernel vulnerability that scores a perfect 10.0 on the CVSS scale. That is the highest rating the system allows. The bug is tracked as CVE-2026-44756 and codenamed OVERPASS. It lets an attacker run commands on an SAP server without logging in at all. For any UK business running SAP, this goes to the top of the patch queue today, not next week.

Security firm Onapsis found the SAP kernel vulnerability and reported it to SAP. The two worked together before SAP released a fix. That happened on 8 September, through Security Note 3747649. This is standard practice for a bug this serious: quiet disclosure first, then a coordinated patch. That way, a fix exists before attackers get a detailed map of the problem.

What the SAP kernel vulnerability actually breaks

The fault sits in how the SAP kernel processes something called the Extended Passport. This is a small tracking header that SAP systems attach to requests as they move between servers. When a system reads that header, it trusts a length value inside it. It never checks that the value makes sense. Send a header with a bogus length, and the system reads past the end of the memory it should be looking at.

That is a classic memory corruption bug, the same family of flaw behind decades of serious software vulnerabilities. What makes this one unusual is where it sits. The Extended Passport is processed before SAP checks who you are or what you are allowed to do. So the normal defences never get a chance to act. That includes user roles, password rules and segregation of duties. An attacker does not need an account, a password, or a foothold inside the network. They need only a network path to the SAP service.

Onapsis says that path can arrive three ways. One is the web interface most SAP systems expose. Another is the SAP GUI protocol used by desktop clients. The third is the remote function calls that SAP systems use to talk to each other. A successful attack hands over arbitrary operating system command execution with SAP’s own administrative privileges. In practice, that means full control of the box.

Which systems are affected

The flaw lives in shared kernel code, so it touches a wide slice of the SAP product family: S/4HANA, the older ECC Business Suite, NetWeaver Application Server, Web Dispatcher, BW/4HANA, Enterprise Portal, PI/PO and Solution Manager. Affected kernel versions span from the ageing 7.22 line right through to current 9.x releases. So this SAP kernel vulnerability is not a problem limited to legacy installs. If your organisation runs SAP at all, assume it needs checking.

SAP’s September patch day also carried three other high-severity fixes alongside OVERPASS. One was a 9.8-rated flaw in the NetWeaver Message Server, CVE-2026-58240. Another was a 9.4-rated credential disclosure bug in the SAP Cloud Application Programming Model. The third was a 9.0-rated access control issue in SAP GUI for Java. None reach OVERPASS’s severity. But a patch cycle carrying four vulnerabilities above CVSS 9.0 is not a routine month.

No confirmed exploitation, but don’t relax

Onapsis and SAP say there is no evidence yet of this SAP kernel vulnerability being exploited in the wild. That is genuinely good news, but it buys days, not months. Bugs like this, ones that work before login, follow a familiar path once word gets out. Technical write-ups follow the patch. Proof-of-concept code comes next. Automated scanning follows within weeks. The gap between “patched” and “exploited” tends to shrink every year.

Onapsis CTO JP Perez-Etchegoyen put the authentication point plainly. Locking user accounts does nothing here. Tightening roles does nothing here either, and nor does enforcing stronger passwords. The vulnerable code runs before any of that is checked. It is a reminder that identity controls, however well managed, cannot compensate for a flaw sitting underneath them.

A pattern worth recognising

This SAP kernel vulnerability is not the first time a widely used enterprise platform has shipped a pre-authentication flaw this severe. Similar bugs have surfaced over the years in VPN appliances, file transfer software and identity platforms. The aftermath usually follows the same shape: a quiet window where only the vendor and researcher know the details, then a scramble once technical write-ups and proof-of-concept exploits appear. What makes OVERPASS distinctive is the sheer footprint of SAP itself. Few enterprise platforms sit this close to the centre of a business, holding finance data, supplier records and payroll in one place.

That footprint is also why SAP’s own patch schedule matters so much here. Kernel patches are not always easy to apply. They can need downtime and tests against custom code. They need teamwork between the people who run the infrastructure and the people who run the apps on top of it, and those two groups do not always talk each day. None of that is a reason to wait. It is a reason to start the conversation with those teams today, rather than after a proof-of-concept exploit turns this into an emergency call at short notice.

What businesses should do this week

Apply SAP Security Note 3747649 now, starting with internet-facing systems before moving to internal ones. There is no configuration workaround; the kernel itself needs patching. While that rollout happens, watch for a few warning signs: unusual requests reaching exposed SAP services, unexpected process activity under SAP’s operating system accounts, and any sign of credential or database access that does not match normal patterns.

Routine vulnerability scanning may well flag an out-of-date SAP kernel version, provided the scan reaches that deep into the estate at all. But it would not have told you, before this week, that the kernel had a pre-authentication flaw waiting to be found. That gap is exactly why patch management and periodic testing need to run alongside each other. Neither one replaces the other.

This is also a moment to check whether your SAP estate should ever have been this exposed in the first place. A pre-authentication kernel bug is a stark test of network segmentation. Which SAP interfaces are reachable from the open internet, and which should sit behind a firewall or VPN regardless of patch status? Businesses that already run regular internal network penetration testing will have a clearer answer than those relying on patching alone.