CVE-2026-44756

Memory Corruption vulnerability in SAP Extended Passport (EPP) Processing

No known exploitation. EPSS puts it in the 50th percentile. No fix published yet.

CVSS 3.110.0Critical EPSS percentile50th0.7% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-09-08Updated 2026-09-22Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditions, an unauthenticated attacker could exploit a crafted network request containing a malformed EPP header, potentially resulting in undefined behavior and abnormal program termination. Successful exploitation may have a high impact on the confidentiality, integrity, and availability of the application.

In plain language

Written by AI from the record

CVE-2026-44756 is a memory-safety flaw in SAP Extended Passport (EPP) Processing that can let an unauthenticated attacker crash or malfunction the software using a specially crafted network request; you should treat it as serious if your system processes EPP requests.

An unauthenticated remote attacker can trigger memory corruption in SAP Extended Passport (EPP) Processing by sending a crafted network request with a malformed EPP header, potentially causing crashes or undefined behavior (CWE-120).

If you're affected

Service outage
Unreliable system behavior
Possible sensitive data exposure
Possible data integrity loss

What is it

This bug is like a mistake in how the software reads a network “passport header” message. If the message is malformed in a certain way, an attacker who can reach the EPP processing can cause the software to crash or behave unpredictably, which can stop service and potentially affect the accuracy and safety of data.

Who is affected

This matters to you if your business runs SAP Extended Passport (EPP) Processing and that component is actively processing Extended Passport Protocol (EPP) requests. It’s a remote risk because the flaw does not require login or user actions. Exposure depends on whether EPP processing is reachable from the network in your environment and whether your system is actually handling EPP requests.

How urgent is it

This is RED because the flaw is remote and unauthenticated and can crash the application or cause unpredictable behavior when processing malformed EPP headers. Even though there’s no confirmed in-the-wild exploitation reported in the provided sources, the potential impact includes service availability and possible data security/integrity issues, and no fixed patch is currently identified in the available findings.

What to do — in detail

Confirm exposure in your environment

Identify whether SAP Extended Passport (EPP) Processing is enabled and actually processing Extended Passport Protocol (EPP) requests.
Determine the network reachability of the EPP processing path/endpoints (for example, is it reachable from the public internet, a partner network, or only via internal systems/VPN?). The findings indicate network-triggered behavior without login.

Check for a vendor fix or mitigation

The provided findings include no fix/patch information for CVE-2026-44756. Ask your SAP support contact or check SAP Security Notes/updates for the presence of a fixed version for your exact SAP Extended Passport (EPP) Processing release.
If a fixed version exists for your branch, plan an upgrade immediately; otherwise, proceed with the network and compensating controls below.

Apply concrete compensating controls (especially if reachable from untrusted networks)

Restrict who can send EPP requests: limit inbound network access to only known IPs/partners/systems that must submit EPP requests.
Add firewall or reverse-proxy rules to block any unsolicited traffic to the EPP processing interface.
If you have multiple environments, ensure only the needed environment(s) can receive EPP traffic.

Detection and monitoring while patching is pending

Watch application logs/monitoring for crashes, abnormal termination, and repeated parsing/validation errors related to EPP headers.
If you see failures, collect timestamps and request-level metadata (where available) to help your IT team/SAP support determine whether malformed headers triggered the issue.

Operational readiness

Ensure you have a reliable recovery/roll-back plan for the EPP processing component and the ability to quickly suspend/limit inbound EPP traffic if stability issues appear.

Technical context

CVE-2026-44756 is a memory corruption vulnerability (CWE-120) in SAP Extended Passport (EPP) Processing. Findings indicate an attacker can send a specially crafted network request with a bad/malformed EPP header to cause a crash or undefined behavior without any login and with no user interaction required. There is no KEV listing in the provided sources, no public exploit code on record, and no dated press claim of active exploitation or incidents. A fix is not identified in the provided findings, so remediation is currently focused on confirming exposure, restricting network reachability of EPP processing, and monitoring for crash/termination patterns. The EPSS figure is provided only as a prediction in the findings and should not be treated as evidence of active exploitation; no overriding KEV/news confirmation was provided.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS50th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.7% chance of exploitation activity in the next 30 days, which ranks it in the 50th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

7 events over 14 days, from the signal feeds we watch.

2026-09-22Record updated
2026-09-08Publishedweakness classified, att&ck mapped, record updated, record updated, record updated

Affected products

SAP_SEcommercial · DEaka sap businessobjects business intelligence platform, sap netweaver application server for abap
- SAP Extended Passport (EPP) ProcessingOn-premEnterprise Software / erp

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Scored 10.0 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope ChangedThe exploit can affect other components (e.g. sandbox escape, host compromise from VM)

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable