CVE-2026-44756 – SAP Extended Passport (EPP) Processing
“A single malformed header is all it takes: when an unauthenticated request can reach your SAP core, every minute unpatched is a minute exposed.”
SAP has released a fix for a memory safety vulnerability in its Extended Passport Protocol (EPP) processing library. CVE-2026-44756 has a CVSS score of 10.0, Critical severity. The flaw is a classic buffer overflow (CWE-120). An unauthenticated attacker can send a crafted network request with a malformed EPP header to trigger undefined behavior and crash the application.
The vulnerability enables remote code execution and carries a high impact on confidentiality, integrity, and availability. No authentication is required, so any exposed SAP system processing EPP traffic is at risk. Apply this update the same day.
Key Details
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- None
- User Interaction
- None
- CWE Classification
- CWE-120