Our S.O.S. line:
+49 89 262 025954
Our team of experts is ready to assist your organization in the event of a cyberattack.
details
Critical vulnerability has been found with the CVSS score of 10.0 in CVE-2026-44756.
The company addressed 20 vulnerabilities across multiple products in its September 2026 security updates, including a maximum-severity memory corruption flaw in the SAP Kernel code.
The vulnerability stems from a classic buffer overflow weakness in the Extended Passport Protocol (EPP) processing library. Successful exploitation enables a remote attacker to gain administrative-level code execution on vulnerable SAP hosts, potentially leading to full control of SAP systems, business-critical processes, and enterprise data.
The attack surface includes SAP Internet Communication Manager (ICM), the component responsible for handling inbound and outbound communication between SAP NetWeaver Application Server instances and external networks via HTTP, HTTPS, and SMTP.
Successful exploitation can permit an attacker to read the SAP secure store to recover database credentials, password hashes and all housed business data; read the live session data of logged-in users; extract stored credentials to move laterally into every other SAP system; and modify application data, system configuration and the SAP binaries.
According to Onapsis’ estimates, more than 10,000 Internet-facing SAP systems use the vulnerable component and are potentially exposed to attacks exploiting the CVE-2026-44756 flaw.
Affected kernel versions:
For more information check out the followings:
https://www.bleepingcomputer.com/news/security/sap-warns-of-maximum-severity-overpass-kernel-vulnerability/
https://nvd.nist.gov/vuln/detail/cve-2026-44756
Do you want to be protected from attacks like the above? See our defensive services here: Managed Security – White Hat IT Security
This CVE of the Week is ‘Metabase SQL Injection Vulnerability’ (CVE-2026-72898) with an impressive score of 10.0. The exploit utilizes one of the oldest tool in the hackers’ toolbox: #SQLi. In the popular Open-source Business Intelligence tool, Metabase. Metabase enables [...]
