SURIQ
SAP used its September 2026 Security Patch Day to close a flaw it rates as bad as they come. CVE-2026-44756 carries a CVSS score of 10.0, needs no login, and reaches SAP over the network. It sits in the part of the platform that answers requests before anyone authenticates, which is exactly the part you least want to be fragile.
The bug lives in the code that handles the Extended Passport Protocol, abbreviated EPP. Extended Passport, often called SAP Passport, is the tracing token SAP components attach to requests so a single call can be followed across the stack. Because it is read early and on the request path, the code that parses it runs before authentication. SAP classes the failure as a classic buffer overflow (CWE-120, a buffer copy without checking the size of the input): a request whose EPP header is deliberately malformed makes the parser write past the memory it was handed.
What SAP will confirm, and what it will not. SAP's own description stops at undefined behavior and an unexpected shutdown of the affected process, which reads like a denial of service (DoS). The score tells a fuller story. The vector SAP assigned is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H: network reachable, low attack complexity, no privileges, no user interaction, a changed scope, and high impact to data confidentiality, system integrity, and availability alike. A vendor does not rate a pure crash as a ten. Treat the crash as the demonstrated floor, not the ceiling. No public exploit code, no proof-of-concept, and no in-the-wild activity had surfaced at publication, and the record was not yet in the U.S. National Vulnerability Database, but a maximum-severity memory bug in a pre-authentication parser is the kind that draws attention quickly.
The affected component list is the whole story
Read the affected products before you read anything else. SAP lists the SAP Kernel and, critically, the SAP Web Dispatcher:
- SAP Web Dispatcher: WEBDISP 9.16, 9.18, 9.19, 9.20
- SAP Kernel: KERNEL 7.22, 7.54, 7.77, 7.89, 7.93, 9.16
- SAP Kernel Unicode and non-Unicode lines: KRNL64UC 7.22, 7.53, 8.04 and KRNL64NUC 7.22, 7.22EXT
The Web Dispatcher is the reverse proxy and load balancer SAP places in front of its application servers, and it is routinely the one SAP component that faces the public internet. A defect a Web Dispatcher can parse from an unauthenticated request is a perimeter defect, not an internal one. That single line in the affected list is why this earns a same-day response rather than a routine patch-cycle ticket.
The second pre-authentication SAP kernel memory bug since August
This is not happening in isolation. Last month's patch day brought CVE-2026-34265, an unauthenticated memory-corruption flaw in the SAP NetWeaver Application Server ABAP's handling of the DIAG protocol, scored 9.8. Two consecutive patch days, two critical memory bugs in SAP's pre-authentication network parsers, both corrected at the kernel level. The through line matters more than either CVE: the code paths SAP exposes before a user proves who they are keep yielding memory-safety defects, and the remedy for each is a kernel patch that lands underneath whatever application you actually run. If you triaged the DIAG flaw in August and moved on, this is the same problem wearing a different protocol. Our July patch-day analysis made a related point: the highest score is not always the one to fear, but a pre-authentication ten on an internet-facing component is.
What to do now
The fix is a SAP Kernel patch delivered through SAP Note 3747649, referenced from SAP's September 2026 Security Patch Day. Because the correction is in the kernel, one patched kernel protects every application stack riding on it, and the same patch covers the Web Dispatcher build.
- Patch internet-facing Web Dispatchers first. Those are the instances an unauthenticated attacker can reach with no foothold. Everything else is second priority.
- Confirm the kernel patch level after you apply it. SAP kernel updates are easy to stage and forget; verify the running patch number rather than assuming the note deployed fully.
- Shrink what an unauthenticated request can touch. Until every instance is patched, restrict network access to the Web Dispatcher, the Internet Communication Manager (ICM), and message-server ports so only trusted clients and jump hosts can reach them.
# run as the <sid>adm user on each instance disp+work -version | grep -iE "kernel release|patch number" # Web Dispatcher build on the perimeter box (patch this one first) sapwebdisp -version | grep -iE "kernel release|patch number" # hunt for unexpected process crashes in the work directory grep -ilE "signal|core dumped|process died" /usr/sap/<SID>/<INSTANCE>/work/dev_w* /usr/sap/<SID>/<INSTANCE>/work/dev_webdisp
Whatever monitoring you run, the task this week is narrow: confirm every SAP kernel and Web Dispatcher patch level against SAP Note 3747649, and make sure no unpatched dispatcher is answering requests from the open internet.