SAP disclosed a critical memory safety vulnerability in the Extended Passport Protocol (EPP) processing library that lets an unauthenticated attacker crash or potentially compromise affected SAP kernel and Web Dispatcher components with a single crafted network request.
What Is It
CVE-2026-44756 is a memory safety vulnerability, classified as CWE-120 (buffer copy without checking size of input), in the Extended Passport Protocol (EPP) processing library used by SAP components. Under specific conditions, an unauthenticated attacker can send a crafted network request containing a malformed EPP header, potentially resulting in undefined behavior and abnormal program termination. SAP assigned it a CVSS v3.1 base score of 10.0 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
Why It Matters
Every exploitability dial is set to worst case: network-reachable, low attack complexity, no privileges required, and no user interaction. The scope is changed, meaning successful exploitation can reach beyond the vulnerable component itself; which is why the score tops out at 10.0 rather than 9.8. SAP states successful exploitation may have a high impact on confidentiality, integrity, and availability of the application.
This CVE does not appear in the CISA KEV data available for this brief. That is an absence of information rather than a finding: it does not establish that the vulnerability is unexploited, only that no KEV listing has been confirmed here. Defenders should treat exploitation status as unknown and the urgency as unchanged; the flaw sits in a pre-authentication network path.
What's Vulnerable
SAP lists the following affected versions of SAP Extended Passport (EPP) Processing (default status: unaffected):
- KERNEL: 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 8.04
- KRNL64NUC: 7.22, 7.22EXT
- KRNL64UC: 7.22, 7.22EXT
- WEBDISP / Web Dispatcher: 9.16, 9.18, 9.19, 9.20
Note that Web Dispatcher instances are frequently internet-facing, which meaningfully widens the exposed attack surface. Administrators should confirm the exact affected component and version list against SAP Note 3747649 before scoping remediation.
Patch Status
SAP published this as part of its Security Patch Day process, with remediation detailed in SAP Note 3747649. The CVE record currently carries NVD status "Received," meaning NVD enrichment and CPE assignment are still pending; readers should consult the NVD entry directly for the authoritative publication timestamp and any subsequent revisions. Administrators should apply the kernel and Web Dispatcher patches referenced in the SAP Note and prioritize any externally reachable instances.
Sources
- SAP Security Note 3747649; https://me.sap.com/notes/3747649
- SAP Security Patch Day; https://url.sap/sapsecuritypatchday
- NVD, CVE-2026-44756 (status: Received)