SECURITY ADVISORY
| SAP reference | Security Note 3747649, 8 Sep 2026 | Severity | 10.0 — Critical |
| Authentication | None required | User interaction | None required |
| Affected | SAP kernel: ICM, disp+work, standalone Web Dispatcher | Fix available | Yes — kernel patch, shipped 8 Sep 2026 |
| Researchers | Jonathan Stross, Senior Product Manager Cybersecurity Research & Innovation, Pathlock Raschin Tavakoli, Security Researcher, nullFaktor GmbH | Date / status | 15 Sep 2026 |
CVE-2026-44756 is a critical vulnerability in Extended Passport processing. The flaw is particularly serious because a crafted request can reach vulnerable SAP kernel code before authentication, potentially allowing an attacker without an account to take control of an affected system.
The researchers conducted controlled laboratory testing to better understand the vulnerability and its potential impact on affected organisations and developed practical guidance on protecting SAP systems against this threat.
Recommendation
Patch every SAP kernel and every standalone SAP Web Dispatcher against SAP Security Note 3747649 as an emergency change, internet-facing systems first. The available kernel patch closes all four attack paths. There is no configuration-only fix for application server ports. Until a system is patched, restrict network reach to its SAP ports not only HTTP(S) at the firewall.
Do not wait for the next patch cycle or for evidence of exploitation. Public technical analysis, independent laboratory confirmation of remote code execution (RCE), and a BSI advisory were published within 48 hours of the patch. This significantly lowers the barrier to exploitation: attackers can use the publicly available analysis and confirmed RCE findings to accelerate exploit development, particularly with AI-assisted reverse engineering.
1. What is at risk
The defect is in the Extended Passport (EPP) processing library shared kernel code that reads a small tracing record attached to every incoming connection. The library trusts the sender’s own declaration of how much data follows and copies that much into a fixed-size stack buffer without checking that it fits. A sender can declare more than the buffer holds; the write then runs past the end and over the saved return address, which is what turns memory corruption into control of execution. Because the passport is read while the connection is still being established, this code is reached before any authentication decision, password policy, MFA, user locks, roles and SoD controls are all evaluated later and offer no protection.
Four pre-authentication attack paths
| Transport | Reaches | Exposure note |
|---|---|---|
| HTTP / HTTPS | ICM, or a standalone Web Dispatcher | The tier serving Fiori, WebGUI, web services and APIs — and the tier most often published to the internet |
| SAP GUI (DIAG) | Dispatcher port on the application server | Present on essentially every ABAP system by design, reachable from the internal network |
| Classic RFC | Gateway port | Affected because the vulnerable parsing occurs in the shared ABAP communication layer before authentication. Eequests arriving via the Gateway can reach the same vulnerable code path. |
| WebSocket RFC (NGRFC) | A dialog work process, via the ICM | Rides on the same HTTPS port as ordinary web traffic. Disabling WebSocket support in the SAP configuration does not close this path — the vulnerable parsing runs before that setting is checked |
Scope. The footprint spans a wide variety of SAP products like S/4HANA, ERP and Business Suite (ECC), NetWeaver AS ABAP and Java, the Web Dispatcher, BW/4HANA, Enterprise Portal, PI/PO and Solution Manager. Application servers and standalone Web Dispatchers must be patched and verified independently as patching one does not protect the other. A system with no web presence is still exposed through the SAP GUI port.
2. Confirmed impact
| Easily Reproducible | Denial of service is possible as of today. A single unauthenticated request crashes the process handling it. Dialog work processes are pooled and restart automatically, so crashing individual workers is a nuisance rather than an outage. The ICM and a standalone Web Dispatcher are far more exposed, since each runs as a single process or small pool. A crash there is likely to interrupt real service, and automatic restart within seconds makes repeated attempts essentially free. |
| Demonstrated, but requires higher effort by attackers | Remote code execution is confirmed in a controlled laboratory over the network against the ICM/HTTP and NGRFC paths, executing an arbitrary OS command as the account owning the SAP kernel. Against a hardened production target this additionally requires defeating address space randomisation, normally via a second information-leak weakness. Harder than the crash, but a well-documented category in the same pre-authentication surface and exactly the kind of chain motivated actors assemble routinely. |
What to do with this information
The correct takeaway should be that this vulnerbaility is not “less severe than claimed”. It is: definitly severe and exploitable with additional effort, meaning immediate patching is a must. No exploitation in the wild has been publicly confirmed at the time of writing. But this should not be a reason why patching is delayed.
3. Immediate actions
| # | Action | Owner | Timeframe |
|---|---|---|---|
| 1 | Inventory every SAP application server and standalone Web Dispatcher, including non-production and dormant systems. Scope by kernel patch level, not by which services a system exposes | Basis / Infrastructure | Immediate |
| 2 | Patch internet-facing systems to the correction levels in section 4 | Basis / Infrastructure | Emergency change |
| 3 | Patch internal systems | Basis / Infrastructure | Emergency change |
| 4 | Restrict network reach to all four transports where patching is pending, including the WebSocket upgrade path | Network | Immediate, interim |
| 5 | Deploy detection for oversized or malformed passport values, and for unexplained ICM or work process crashes (if possible) | SOC / Network | In parallel |
| 6 | Re-verify patch level after the change | Basis / Infrastructure | Post-change |
| 7 | Apply the newest SAP Host Agent patch level, and close SAP Note 3759472 (CVE-2026-58240, Message Server) in the same window | Basis / Infrastructure | Same change window |
| 8 | Retain patch and compensating-control evidence per system for the audit trail | Compliance / Audit | Ongoing |
Do not test this against production
The patch changes the behaviour of systems to reject oversized and undersized passport items. Detection scripts based on traffic probes therefore either tell you nothing or could kill a worker process. Instead of that verify the patch level e.g. using the programm disp+work -V on an application server. Note that you need a separate read for each standalone Web Dispatcher, since it carries its own copy of the library.
On the available workaround. The SAP Note 3756304 documents one workaround, but its scope is narrow and easy to misread: since it applies only to HTTP(S) traffic received through a standalone Web Dispatcher that has been updated. It covers none of the other three protocols (RFC, DIAG, NGRFC) and no directly reachable application server. For ICM, dispatcher and gateway ports there is no workaround available other than network restriction or the kernel patch.
4. Correction levels
This table shows the affected sftware components based on the SAP Security Note 3747649 (note version 7). Note that higher patch levels also contain the correction.
| Software component | Patch level | Software component | Patch level |
|---|---|---|---|
| SAP KERNEL 7.22 EXT / EX2 / EX3 | 001518 | SAP KERNEL 8.04 | 000242 |
| SAP KERNEL 7.53 | 001610 | SAP KERNEL 9.16 | 000100 |
| SAP KERNEL 7.54 | 000646 | SAP KERNEL 9.18 | 000029 |
| SAP KERNEL 7.77 | 000912 | SAP KERNEL 9.19 | 000014 |
| SAP KERNEL 7.93 | 000401 | SAP KERNEL 9.20 | 000004 |
| SAP KERNEL 7.93 | 000412 | SAP WEB DISPATCHER 9.16 | 000100 |
Three edge cases for the affected Software components:
- Kernel 7.93 is listed twice (patch 401 and 412) with no explanation of the distinction. Check SAP’s package applicability for the specific installation.
- No correction exists for plain kernel 7.22 or 7.89. SAP advises moving to the corresponding downward-compatible kernel per Note 2083594. These need an explicit decision and a named owner Systems with these kernel versionst are the ones most likely to be left behind.
- Web Dispatcher scope is narrower than the component list suggests. SAP’s affected-release statement limits it to 9.16 below patch level 100 and excludes the Web Dispatcher bundled with SAP HANA XS, while the components section also lists 9.18, 9.19 and 9.20. Raise the discrepancy through SAP support if it affects your estate.
Correction Packages: For Application servers: use the latest SP Stack Kernel files (SAPEXE.SAR, SAPEXEDB.SAR) where it already contains the correction, or the hotfix dw.sar (SAP Notes 2083594, 19466). For standalone Web Dispatchers: use the SAPWEBDISP.SAR (SAP Note 908097). For embedded Web Dispatcher: patched with the application server kernel (SAP Note 3115889). Review the regression note for the target patch level before installing (SAP Note 1802333).
5. Detection and IOCs
There are two signals that can be monitored for, while the patching takes place:
- Oversized or malformed passport values. A legitimate passport is small — around 230 bytes on the wire. A value far larger, or one missing the expected leading marker, has no benign explanation. Detectable in a SIEM where the SAP network headers are logged, and on the wire by a network sensor independent of SAP-side logging.
- Unexplained crashes and restarts. A successful trigger corrupts the return address, a trace signature distinct from an ordinary segmentation fault. This can be noticed as a repeating crash-restart-crash pattern with no application error underneath It is advisable to rreserve trace files for the upcoming months for analysis while the patching is underway.
Ready-to-deploy content is available on request
A companion package developed alongside this advisory covers the operational side in full. It is not published openly and is provided at no cost to affected organisations:
- SIEM detection content — Splunk SPL, Microsoft Sentinel KQL and portable Sigma rules, including request-to-crash correlation
- Network signatures covering all four transports, plus a ModSecurity virtual patch for the reverse-proxy tier
- A read-only host validation script that auto-discovers every SAP instance and Web Dispatcher on a host and reports patch level, logging configuration and core-dump readiness in one run
- A Wireshark dissector patch for triaging existing captures, and a lab validation runbook
To request it, contact Pathlock Security Team — via your Pathlock account team or the authors directly.
A note for customers that build their own detection rules. Since exploitation of this vulnerability deals with specific byte manipulation of SAP network traffic, filtering for Specific byte or unit-count thresholds are not a reliable figure and can produce rules that never fires.
6. References
- SAP SE, SAP Security Note 3747649 — [CVE-2026-44756] Memory Corruption vulnerability in SAP Extended Passport (EPP) Processing, 8 September 2026. Authoritative for affected releases and patch levels; CVE record at cve.org/CVERecord?id=CVE-2026-44756. Companion FAQ: Note 3776034. Workaround scope: Note 3756304. Same patch day: Note 3759472 (CVE-2026-58240). Procedural: Notes 2083594, 19466, 1802333, 908097, 3115889.
- BSI, Cybersicherheitswarnung 2026-288588-1032, “SAP — Kritische Schwachstellen bedrohen verschiedene Anwendungen”, version 1.0, 9 September 2026.
- nullFaktor GmbH, “CVE-2026-44756: SAP NetWeaver Pre-Auth Remote Code Execution”, 10 September 2026 — laboratory confirmation of RCE via the ICM/HTTP and NGRFC paths; source of the correction levels in section 4.
