{"id":11793,"date":"2026-09-21T14:56:44","date_gmt":"2026-09-21T20:56:44","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/alert-2026-107-overpass-critical-rce-in-sap-kernel\/"},"modified":"2026-09-29T08:24:05","modified_gmt":"2026-09-29T14:24:05","slug":"alert-2026-107-overpass-critical-rce-in-sap-kernel","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-107-overpass-critical-rce-in-sap-kernel\/","title":{"rendered":"Alert 2026-107 OVERPASS \u2014 Critical RCE in SAP Kernel"},"content":{"rendered":"\n
Affected product(s):<\/h2>\n\n
OVERPASS affects SAP software that uses the vulnerable SAP Kernel<\/strong> code, so the scope may include a significant proportion of SAP landscapes:<\/p>\n\n
SAP product \/ component<\/strong><\/td>
Possible impact<\/strong><\/td><\/tr>
SAP S\/4HANA<\/strong><\/td>
Affected if using a vulnerable SAP Kernel version\/patch level<\/td><\/tr>
SAP ERP \/ SAP Business Suite (ECC)<\/strong><\/td>
Affected if using a vulnerable SAP Kernel version\/patch level<\/td><\/tr>
SAP NetWeaver Application Server ABAP<\/strong><\/td>
Affected if using a vulnerable SAP Kernel version\/patch level<\/td><\/tr>
SAP Web Dispatcher<\/strong><\/td>
Affected if using a vulnerable SAP Kernel version\/patch level<\/td><\/tr>
SAP BW\/4HANA<\/strong><\/td>
Affected if using a vulnerable SAP Kernel version\/patch level<\/td><\/tr>
SAP Enterprise Portal<\/strong><\/td>
Affected if using a vulnerable SAP Kernel version\/patch level<\/td><\/tr>
SAP Process Integration \/ Process Orchestration (PI\/PO)<\/strong><\/td>
Affected if using a vulnerable SAP Kernel version\/patch level<\/td><\/tr>
SAP Solution Manager<\/strong><\/td>
Affected if using a vulnerable SAP Kernel version\/patch level<\/td><\/tr>
Other products built on SAP NetWeaver Kernel<\/strong><\/td>
Potentially affected; validate against SAP Note 3747649<\/td><\/tr><\/tbody><\/table><\/figure>\n\n
Definitive validation must be performed by comparing the kernel version and patch level of each system with SAP Security Note 3747649.<\/strong><\/p>\n\n
The scope criterion must be based on the kernel patch level, not solely on the product or web exposure. Old, development, QA, sandbox, DR, discontinued, or not published to the Internet systems may still be vulnerable through SAP GUI or RFC.<\/p>\n\n
Description<\/h2>\n\n
A vulnerability identified as CVE\u20112026\u201144756<\/strong> and named OVERPASS<\/strong> was identified, a critical remote code execution (RCE<\/strong>) vulnerability in the SAP Kernel. The flaw has a CVSS 10.0<\/strong> score and allows an unauthenticated remote attacker to execute arbitrary operating system commands with the privileges of the SAP administrative account, which can lead to total compromise of the system, its business data, and trust relationships with other SAP environments.<\/p>\n\n
CVE\u20112026\u201144756 (OVERPASS)<\/strong> is a vulnerability in the shared SAP Kernel code responsible for processing Extended Passport (EPP). EPP is a standard functionality used to correlate traces, calls, and messages in distributed SAP and non-SAP landscapes.<\/p>\n\n
An attacker can send a specially crafted request with malformed EPP data to compromise the receiving process and execute operating system commands on the SAP host. The flaw is pre-authentication<\/strong>: EPP is processed when creating the session, so the vulnerable code is reached before SAP evaluates the user, password, authorizations, roles, account locks, or login policies.<\/p>\n\n
Solution<\/h2>\n\n
The definitive solution is to apply the SAP Kernel patch indicated by SAP Security Note 3747649<\/strong>. A single kernel patch fixes the OVERPASS vulnerability in HTTP(S), SAP GUI, and RFC paths.<\/p>\n\n