What’s Vulnerable › Vulnerabilities

CVE-2026-44756: Memory Corruption vulnerability in SAP Extended Passport (EPP) Processing

• Severity: critical (CVSS 10.0 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-09-08 · updated 2026-09-22
• Weakness: CWE-120

Description

A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditions, an unauthenticated attacker could exploit a crafted network request containing a malformed EPP header, potentially resulting in undefined behavior and abnormal program termination. Successful exploitation may have a high impact on the confidentiality, integrity, and availability of the application.

Affected products

• SAP_SE SAP Extended Passport (EPP) Processing: KRNL64NUC 7.22, 7.22EXT, KRNL64UC 7.22, 7.53, 8.04, WEBDISP 9.16 (+9)

In the news

• 2026-011: Critical Vulnerabilities in SAP Kernel and NetWeaver Message Server

References

• https://me.sap.com/notes/3747649
• https://url.sap/sapsecuritypatchday
• http://seclists.org/fulldisclosure/2026/Sep/65

Get alerted when CVE-2026-44756 or the next vulnerability affects your stack