CVE-2026-44756
Unauthenticated request can corrupt memory and crash SAP Extended Passport processing.
A memory safety flaw in SAP Extended Passport (EPP) Processing allows an unauthenticated attacker to send a crafted network request with a malformed EPP header. This can corrupt memory, cause undefined behavior, and abnormally terminate the program, with high impact on confidentiality, integrity, and availability. No fixed version is listed in the record, and the vulnerability is not on CISA's known-exploited list.
SAP_SE SAP Extended Passport (EPP) Processing · Updated 28 Oct · From the public records
Being exploitedNot reportedNo attacks reported in the records
CISA known exploitedNot listedThe US list of flaws under attack
SeveritycriticalCVSS 10.0 of 10
FixNot yetSee what to do below
Am I affected?
The records do not list fixed versions yet. Check the vendor's advisory below.
What to do
- Because no fixed version or workaround is provided in the records, watch CERT-EU advisory 2026-011 and SAP security notices for a patch.
- Until a patch appears, limit network access to the affected SAP Extended Passport processing service so only trusted systems can reach it.
What happened
- 28 OctCERT-EU released advisory 2026-011 about critical vulnerabilities in SAP Kernel and NetWeaver Message Server.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-44756 | Memory Corruption vulnerability in SAP Extended Passport (EPP) Processing | critical 10.0 | No | 1.4% |
Our reporting
We have not reported on it. It is here because the sources below did.
Reported elsewhere
CERT-EU2026-011: Critical Vulnerabilities in SAP Kernel and NetWeaver Message Server ↗The records
CVE-2026-44756 on NVD ↗Is anything you run affected?Members connect Zotpaper to their AI assistant. It checks your own project against every vulnerability on this page and the others we track, and says what to update.
How it works