Posted on

SAP OVERPASS CVE-2026-44756 – Pre-Authentication SAP Kernel Remote Code Execution

Threat Overview

SAP’s September 8, 2026 Security Patch Day addressed CVE-2026-44756, named OVERPASS by Onapsis Research Labs. The vulnerability is a CVSS 10.0 memory-corruption flaw in SAP Extended Passport (EPP) processing inside shared SAP kernel code. Onapsis states that the flaw is remotely exploitable without authentication and can allow an attacker to execute arbitrary operating-system commands as the SAP system account, resulting in full compromise of SAP business data and processes.

The attack surface is unusually broad because EPP is processed by multiple SAP communication paths before authentication. Onapsis confirmed exposure through the web layer using SAP Internet Communication Manager (ICM) and SAP Web Dispatcher, through the SAP GUI/Dispatcher layer, and through RFC connections. Internet exposure is not required for every affected system: internal SAP GUI and RFC reachability can also expose vulnerable systems after an attacker gains a foothold on a trusted network. SAP Security Note 3747649 is the authoritative remediation reference.

Onapsis had not observed active in-the-wild exploitation as of its September 8 publication. The researcher intentionally withheld exploit details under coordinated disclosure. No public exploit path, malicious request pattern, or attacker IOC should therefore be invented.

References

Impacted Systems

Vendor/product: SAP products using affected SAP kernel/EPP processing. Publicly listed affected kernel families in SAP Security Note 3747649 include KRNL64NUC 7.22 and 7.22EXT; KRNL64UC 7.22, 7.22EXT, 7.53, and 8.04; WEBDISP 9.16, 9.18, 9.19, and 9.20; and KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04, 9.16, 9.18, 9.19, and 9.20. Product families potentially inheriting the affected kernel include SAP S/4HANA, SAP ERP / Business Suite ECC, SAP NetWeaver Application Server ABAP, SAP Web Dispatcher, SAP BW/4HANA, SAP Enterprise Portal, SAP PI/PO, SAP Solution Manager, and other software built on the same kernel. Exposure paths: HTTP/HTTPS through ICM/Web Dispatcher, SAP GUI through Dispatcher, and RFC. Authentication is not required to reach the vulnerable EPP processing path. Fixed kernel patch levels are defined in SAP Security Note 3747649 and should be validated there rather than guessed from public version families.

Why this matters

OVERPASS is a pre-authentication CVSS 10.0 flaw in shared SAP kernel code that can cross multiple protocols and affect high-value business systems. Successful exploitation can expose database credentials, password hashes, live sessions, business data, system configuration, connected SAP trust relationships, and the SAP binaries themselves.

Criticality: Critical – Emergency patch and exposure-review priority.

Exploitation Status

No confirmed in-the-wild exploitation was identified in the reviewed sources as of September 9, 2026. Onapsis explicitly stated that it had not observed active exploitation as of its September 8 publication. Exploit details were intentionally withheld. The risk rating is driven by unauthenticated remote code execution, broad kernel reuse, multiple reachable protocols, and the sensitivity of SAP systems rather than a confirmed active campaign.

What this hunt looks for

Available Microsoft Sentinel telemetry can be reviewed for unexpected sources reaching SAP web, Dispatcher, Gateway, or RFC services; new source addresses compared with baseline; suspicious child processes of SAP kernel/web processes; rare outbound connections from SAP application hosts; unexpected executable or script creation by SAP processes; new persistence on Windows-hosted SAP systems; and SAP/Linux Syslog anomalies where those sources are ingested. No exploit-request signature is asserted because Onapsis and SAP have not publicly disclosed the EPP exploit payload.

Required logs

  • CommonSecurityLog from firewalls, WAFs, reverse proxies, or network devices protecting SAP services
  • Microsoft Defender XDR / Defender for Endpoint: DeviceProcessEvents, DeviceFileEvents, and DeviceNetworkEvents where SAP hosts are onboarded
  • Linux Syslog from SAP hosts and/or Windows Security Events in SecurityEvent where relevant

First Pass – New Sources Reaching Known SAP Systems

let SAPServers = dynamic(["REPLACE_WITH_SAP_SERVER_IP"]);
let Baseline = CommonSecurityLog
| where TimeGenerated between (ago(30d) .. ago(2d))
| where DestinationIP in (SAPServers)
| summarize by SourceIP, DestinationIP, DestinationPort;
CommonSecurityLog
| where TimeGenerated > ago(2d)
| where DestinationIP in (SAPServers)
| where DestinationPort in (80,443) or DestinationPort between (3200 .. 3299) or DestinationPort between (3300 .. 3399)
| join kind=leftanti Baseline on SourceIP, DestinationIP, DestinationPort
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Connections=count(), Actions=make_set(DeviceAction,20) by SourceIP, DestinationIP, DestinationPort
| order by FirstSeen desc

Internet or Untrusted Connections to Common SAP Web and Dispatcher Ports

let SAPServers = dynamic(["REPLACE_WITH_SAP_SERVER_IP"]);
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where DestinationIP in (SAPServers)
| where DestinationPort in (80,443) or DestinationPort between (3200 .. 3299) or DestinationPort between (3300 .. 3399)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Connections=count(), Ports=make_set(DestinationPort,20), Actions=make_set(DeviceAction,20) by SourceIP, DestinationIP
| order by Connections desc

SAP Kernel or Web Process Spawning Shells and Network Utilities

let SAPHosts = dynamic(["REPLACE_WITH_SAP_HOSTNAME"]);
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where DeviceName in~ (SAPHosts)
| where InitiatingProcessFileName in~ ("disp+work","icman","sapwebdisp","gwrd","msg_server")
| where FileName in~ ("sh","bash","ksh","csh","cmd.exe","powershell.exe","pwsh.exe","curl","wget","nc","ncat","socat","python","python3","perl")
| project TimeGenerated, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, ProcessIntegrityLevel, SHA256
| order by TimeGenerated desc

Rare Outbound Destinations From SAP Application Hosts

let SAPHosts = dynamic(["REPLACE_WITH_SAP_HOSTNAME"]);
let Baseline = DeviceNetworkEvents
| where TimeGenerated between (ago(30d) .. ago(2d))
| where DeviceName in~ (SAPHosts)
| summarize by RemoteUrl, RemoteIP;
DeviceNetworkEvents
| where TimeGenerated > ago(2d)
| where DeviceName in~ (SAPHosts)
| where (RemoteUrl, RemoteIP) !in (Baseline)
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, Protocol
| order by TimeGenerated desc

SAP Processes Creating Executables or Scripts

let SAPHosts = dynamic(["REPLACE_WITH_SAP_HOSTNAME"]);
DeviceFileEvents
| where TimeGenerated > ago(14d)
| where DeviceName in~ (SAPHosts)
| where InitiatingProcessFileName in~ ("disp+work","icman","sapwebdisp","gwrd","msg_server")
| where FileName endswith ".exe" or FileName endswith ".dll" or FileName endswith ".so" or FileName endswith ".sh" or FileName endswith ".ps1" or FileName endswith ".py" or FileName endswith ".pl"
| project TimeGenerated, DeviceName, ActionType, FolderPath, FileName, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine
| order by TimeGenerated desc

SAP Host Linux Syslog – Shell, Privilege, and Authentication Anomalies

let SAPHosts = dynamic(["REPLACE_WITH_SAP_HOSTNAME"]);
Syslog
| where TimeGenerated > ago(14d)
| where Computer in~ (SAPHosts)
| where SyslogMessage has_any ("sudo","session opened","authentication failure","useradd","passwd","cron","crontab","systemctl","service","bash","sh -c")
| project TimeGenerated, Computer, Facility, SeverityLevel, ProcessName, SyslogMessage
| order by TimeGenerated desc

New Windows Services on SAP Hosts

let SAPHosts = dynamic(["REPLACE_WITH_SAP_HOSTNAME"]);
SecurityEvent
| where TimeGenerated > ago(14d)
| where Computer in~ (SAPHosts)
| where EventID == 7045
| project TimeGenerated, Computer, SubjectUserName, ServiceName, ServiceFileName, ServiceType, ServiceStartType
| order by TimeGenerated desc

Windows Process-Creation Fallback for SAP Parent Processes

let SAPHosts = dynamic(["REPLACE_WITH_SAP_HOSTNAME"]);
SecurityEvent
| where TimeGenerated > ago(14d)
| where Computer in~ (SAPHosts)
| where EventID == 4688
| where ParentProcessName has_any (@"\disp+work.exe",@"\icman.exe",@"\sapwebdisp.exe",@"\gwrd.exe",@"\msg_server.exe")
| where NewProcessName has_any (@"\cmd.exe",@"\powershell.exe",@"\pwsh.exe",@"\rundll32.exe",@"\certutil.exe")
| project TimeGenerated, Computer, SubjectUserName, ParentProcessName, NewProcessName, CommandLine
| order by TimeGenerated desc

Detection Notes

The most reliable action is exposure and patch validation against SAP Security Note 3747649. Because exploit details are intentionally withheld, there is no defensible CVE-specific HTTP, RFC, or SAP GUI signature to place in Sentinel today. The common SAP port ranges in the network queries are defaults/conventions and may differ in a specific landscape; substitute the actual ports from the SAP inventory. SAP processes can legitimately spawn helper programs, so process-child findings require host-role and baseline context. The highest-signal behavioral finding would be a SAP kernel/web process spawning an unexpected shell followed by a new outbound destination or persistence change. Generic firewall telemetry cannot see the EPP payload if the request is encrypted.