{
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "NetWeaver AS ABAP (S/4HANA)",
          "vendor": "Sap",
          "versions": [
            {
              "status": "affected",
              "version": "unknown"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Raschin Tavakoli via Fulldisclosure"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "nullFaktor Security Advisory \u003c 2026-09-10 \u003e\n===========================================================\nTitle:               Pre-Authentication Remote Code Execution in SAP\n                     Extended Passport (EPP) processing library\nAffected Components: ICM, SAP Web Dispatcher, dialog work processes\n\nVulnerability:       Stack based Buffer Overflow\nCVE:                 CVE-2026-44756\n\nImpact:              Critical\nCVSS 4.0 Vector:     CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:\n                     H/VI:H/VA:H/SC:H/SI:H/SA:H\nCVSS 4.0 Score:      10\nSAP CVSS 3.0 Score:  10.0\nSAP CVSS Vector:     CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H\n\nProducts:            SAP NetWeaver AS ABAP and Java\n                     SAP Web Dispatcher\nAffected Versions:   NetWeaver kernel releases and patch levels:\n                     see the correction table below\n                     SAP Web Dispatcher 9.16, patch level below 100\n\nVendor Homepage:     http://www.sap.com\n\nSAP Note:            3747649 (version 7, released 2026-09-08)\n\nDate:                2026-09-10\nAuthor:              Raschin Tavakoli | nullFaktor GmbH\n                     https://www.nullfaktor.com\n                     office () nullfaktor com\nBlog:                https://www.nullfaktor.com/blog/\n                     cve-2026-44756-sap-netweaver-pre-auth-rce\n\nVulnerability\n===============\nDuring our research we discovered a stack-based buffer overflow in\nthe Extended Passport (EPP) processing, kernel code shared by\nseveral SAP components: the SAP Internet Communication Manager\n(ICM), the SAP Web Dispatcher, and the disp+work work processes of\nthe ABAP application server. Missing bounds validation on\nexternally supplied metadata corrupts stack memory and allows an\nunauthenticated remote attacker to redirect the execution flow,\ngaining full control of the SAP server.\n\nThe vulnerable code is reachable through several protocols, all of\nthem before authentication: HTTP and HTTPS, the WebSocket RFC\n(NGRFC) protocol, classic RFC, and the SAP GUI (DIAG) protocol.\n\nThis advisory demonstrates three of these paths in the laboratory:\n\n1. HTTP(S) into the ICM: the overflow executes inside the Internet\n   Communication Manager itself.\n2. WebSocket RFC (NGRFC) into a disp+work dialog work process: the\n   Internet-facing ICM terminates the WebSocket connection and\n   hands the crafted NGRFC login envelope to a dialog work process,\n   which parses it before any logon check. With an SAP Web\n   Dispatcher in front, it tunnels the upgraded connection to the\n   ICM first.\n3. Classic RFC into a disp+work dialog work process: the gateway\n   accepts the same TLV login structure, including the crafted\n   passport, before sign-on.\n\nNGRFC, SAP\u0027s WebSocket-based Next Generation RFC, tunnels classic\nRFC (a protocol family from the R/2 and R/3 era) over WebSocket and\nHTTPS. Until NGRFC, work processes were reachable only through the\ninternal DIAG and classic RFC ports. NGRFC exposes the work\nprocess, the component that executes the ABAP business logic and\nholds database connections, credentials and active user sessions,\nthrough the Internet-facing HTTPS port for the first time. Systems\nwhose administrators disabled WebSocket support, believing this\npath to be closed, remain fully exposed: laboratory tests showed\nthe vulnerable code is still reachable without authentication over\nthe Internet-facing port. The classic RFC protocol carries the same\nExtended Passport processing, so transport-level switches cannot\nsubstitute for the kernel patch.\n\nIn the laboratory, nullFaktor escalated the overflow over the\nnetwork to full remote code execution, in the context of the ICM\nprocess or, via the WebSocket RFC path, of a disp+work dialog work\nprocess. The code execution chain combines control of the saved\ninstruction pointer with a memory leak that resolves process\naddresses and defeats ASLR. The memory-leak primitive, the resolved\naddress data, the payload and the detailed trigger conditions are\nwithheld from this advisory for now and will be published at a\nlater time. The leak will be covered in a separate advisory.\n\nBecause the EPP processing code is part of the kernel library linked\ninto the work processes themselves, the same input also reaches a\ndisp+work process over classic RFC (gateway port 33\u003cNN\u003e) and over\nthe DIAG protocol (SAP GUI logons, dispatcher port 32\u003cNN\u003e). The\nclassic RFC path is confirmed in the laboratory (see the Proof of\nConcept section); the DIAG path follows from the same shared code.\n\nThe affected stack frame is not protected by a stack canary,\nalthough the binary is compiled with canary support, so the\noverwrite continues uninterrupted until the function returns into\nthe chosen address. The Proof of Concept section verifies this\nagainst the binary and at runtime.\n\nThe EPP component and the missing boundary validation are identified\nin SAP Security Note 3747649.\n\nVendor description:\n===================\nSAP SE is a European multinational software company based in Walldorf,\nBaden-Wuerttemberg, Germany. It develops enterprise software to manage\nbusiness operations and customer relations.\n\nSAP is the world\u0027s largest enterprise resource planning (ERP) vendor and\nthe largest software company in Europe. 77% of the world\u0027s transaction\nrevenue touches an SAP system, and 87% of total global commerce is\ngenerated by SAP customers. 92% of the Forbes Global 2000 companies run\nSAP, as do 98% of the 100 most valued brands, with over 440,000\ncustomers in 180+ countries.\n\nTested Environment:\n====================\nProduct:     SAP NetWeaver AS ABAP (S/4HANA)\nKernel:      793, patch 101 (Aug 2 2024)\nSAP_BASIS:   757 SP 3\nPlatform:    Linux x86_64\n\nAffected Products and Correction Levels:\n========================================\nThe following vendor scope and correction levels are taken from SAP\nSecurity Note 3747649, version 7, released September 8, 2026.\n\nAffected products according to SAP:\n\n- SAP NetWeaver AS ABAP and Java with kernel patch levels below the\n  applicable correction level listed in the note.\n- SAP Web Dispatcher 9.16 with patch levels below 100.\n\nSAP explicitly excludes other SAP Web Dispatcher versions and the Web\nDispatcher included in SAP HANA Extended Application Services.\n\nAll kernel releases named in the note are listed with their correction\nlevels in the table below.\n\nCorrection entries from the note\u0027s Support Package Patches section:\n\nSoftware component / variant                 Support Package Patch Level\n-------------------------------------------  --------------- -----------\nSAP KERNEL 7.22 EXT, 64-BIT / 64-BIT UC      SP1518           001518\nSAP KERNEL 7.22_EX2, 64-BIT / 64-BIT UC      SP1518           001518\nSAP KERNEL 7.22_EX3, 64-BIT / 64-BIT UC      SP1518           001518\nSAP KERNEL 7.53, 64-BIT / 64-BIT UNICODE     SP1610           001610\nSAP KERNEL 7.54, 64-BIT / 64-BIT UNICODE     SP646            000646\nSAP KERNEL 7.77, 64-BIT UNICODE              SP912            000912\nSAP KERNEL 7.93, 64-BIT UNICODE              SP401            000401\nSAP KERNEL 7.93, 64-BIT UNICODE              SP412            000412\nSAP KERNEL 8.04, 64-BIT UNICODE              SP242            000242\nSAP KERNEL 9.16, 64-BIT UNICODE              SP100            000100\nSAP KERNEL 9.18, 64-BIT UNICODE              SP029            000029\nSAP KERNEL 9.19, 64-BIT UNICODE              SP014            000014\nSAP KERNEL 9.20, 64-BIT UNICODE              SP004            000004\nSAP WEB DISPATCHER 9.16                      SP100            000100\n\nSAP states that higher patch levels also contain the correction for\nthe applicable release. For kernel 7.93, the note lists both patch 401\nand patch 412 without explaining the distinction. Both entries are\npreserved here. Consult SAP\u0027s package applicability when selecting the\nupdate for a particular installation.\n\nAs of note version 7 (September 8, 2026), no separate correction entry\nexists for plain kernel 7.22 or kernel 7.89, so no fixed patch level\ncan be stated for these releases. SAP advises that kernels that are\nout of maintenance and for which no correction is available be\nupgraded to the corresponding downward-compatible kernel (DCK). See\nSAP Note 2083594.\n\nThe note\u0027s Software Components section also lists WEBDISP 9.18,\n9.19 and 9.20. The note does not explain these entries. Because\nSAP\u0027s explicit affected-release statement limits the affected Web\nDispatcher product to version 9.16 and states that other Web\nDispatcher versions are not affected, these component entries are\nnot treated as affected Web Dispatcher versions in this advisory.\n\nTimeline:\n=========\n2026-07-14 nullFaktor reports the vulnerability to SAP PSRT\n           (responsible disclosure)\n2026-07-14 SAP assigns ticket PSINC0012548\n2026-07-15 SAP PSRT informs nullFaktor that the vulnerability was\n           also discovered by another researcher and that a patch is\n           planned for the August 11 patch day\n2026-07-15 SAP PSRT confirms that nullFaktor will be credited on\n           SAP\u0027s security acknowledgement page\n2026-08-06 nullFaktor asks SAP whether the patch will be released\n           on the August patch day as planned\n2026-08-06 SAP PSRT confirms a delay. The patch is now scheduled\n           for September\n2026-09-08 SAP releases the patch (SAP Security Note 3747649).\n           SAP\u0027s security acknowledgement page lists the other\n           researcher for CVE-2026-44756, but not nullFaktor.\n           nullFaktor asks SAP PSRT to correct this\n2026-09-10 SAP PSRT apologizes for the omission and commits to\n           crediting nullFaktor on the acknowledgement page with\n           the October 2026 patch day\n2026-09-10 Public advisory release\n\nAttribution: nullFaktor identified this vulnerability independently\nduring its own research and confirmed it in the laboratory. SAP PSRT\ninformed nullFaktor on 2026-07-15 that the vulnerability had also\nbeen discovered by another researcher. Onapsis Research Labs\nseparately reported the vulnerability to SAP and published it under\nthe name OVERPASS, describing the web, SAP GUI and classic RFC\naccess vectors without technical exploitation detail. The WebSocket\nRFC (NGRFC) transport into dialog work processes documented in this\nadvisory is not covered there.\n\nVendor Recommendations (SAP Security Note 3747649)\n=================================================\nApply the corrections described in SAP Security Note 3747649, released\non September 8, 2026, using the applicable correction levels listed in\nthis advisory.\n\nSAP NetWeaver AS ABAP and Java:\n\n1. Apply the latest SP Stack Kernel if it already contains the\n   correction. Consult SAP Note 2083594 for kernel versions and patch\n   levels. Otherwise, SAP states that the next SP Stack Kernel will\n   deliver the correction. Use the hotfix if the correction is needed\n   on short notice.\n2. If no correction is available for an out-of-maintenance kernel,\n   upgrade to the corresponding downward-compatible kernel (DCK),\n   following SAP Note 2083594.\n3. Before installing, review the regression note for the target patch\n   level. SAP Note 1802333 explains how to find this information.\n4. Follow SAP Note 19466 for downloading and installing kernel patches.\n\nKernel update packages named by SAP:\n\n- Hotfix: dw.sar.\n- SP Stack Kernel: SAPEXE.SAR and SAPEXEDB.SAR.\n\nFor detailed update-strategy recommendations, SAP refers to the paper\n\"Update Strategy for the Kernel of the Application Server ABAP in On\nPremise Landscapes\".\n\nSAP Web Dispatcher:\n\n- Standalone deployment: use SAPWEBDISP.SAR and follow SAP Note 908097\n  for the recommended version, download and installation procedure.\n- Embedded deployment: use dw.sar, or SAPEXE.SAR and SAPEXEDB.SAR,\n  following the Application Server kernel patching procedure.\n- SAP Note 3115889 explains standalone versus embedded deployment.\n\nSAP Host Agent:\n\n- SAP also recommends installing the newest SAP Host Agent patch\n  level. The note does not specify a minimum Host Agent level.\n\nTemporary workaround:\n\nSAP Note 3756304 documen"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T04:57:32Z",
        "orgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
        "shortName": "VULNARCHIVE"
      },
      "references": [
        {
          "tags": [
            "technical-description",
            "exploit"
          ],
          "url": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/65"
        },
        {
          "tags": [
            "technical-description"
          ],
          "url": "https://seclists.org/fulldisclosure/2026/Sep/65"
        },
        {
          "url": "http://www.sap.com"
        },
        {
          "url": "https://nmap.org/mailman/listinfo/fulldisclosure"
        },
        {
          "url": "https://seclists.org/fulldisclosure/"
        },
        {
          "url": "https://www.nullfaktor.com"
        },
        {
          "url": "https://www.nullfaktor.com/#kontakt"
        },
        {
          "url": "https://www.nullfaktor.com/blog"
        },
        {
          "url": "https://www.nullfaktor.com/blog/"
        },
        {
          "url": "https://x.com/_nullfaktor"
        }
      ],
      "source": {
        "defect": [
          "https://seclists.org/fulldisclosure/2026/Sep/65"
        ],
        "discovery": "EXTERNAL"
      },
      "title": "CVE-2026-44756: Pre-Auth RCE in SAP EPP Processing (ICM, Web Dispatcher, disp+work)",
      "x_gcve": [
        {
          "recordType": "analysis",
          "relationships": [
            {
              "destId": "CVE-2026-44756",
              "type": "related"
            }
          ],
          "vulnId": "GCVE-1988-2026-0404",
          "x_vulnarchive": {
            "archiveUrl": "https://vuln.freearchive.org/archive/full-disclosure/2026/Sep/65",
            "automated": true,
            "contentSha256": "ea5b6a10707c2c76a3cf5b528072ba868d9a941d9f7bd99e16c62b6fcea2edfc",
            "evidenceScore": 10,
            "messageId": "",
            "originalUrl": "https://seclists.org/fulldisclosure/2026/Sep/65",
            "policy": "vulnarchive-1",
            "sourceFormat": "text/html",
            "sourcePublishedAt": "2026-09-12T04:59:15Z"
          }
        },
        {
          "recordType": "advisory",
          "vulnId": "gcve-1988-2026-0404"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "4e2abfbf-4a2a-4b76-a4e0-d77c18ba156c",
    "assignerShortName": "VULNARCHIVE",
    "datePublished": "2026-10-02T04:57:32Z",
    "dateUpdated": "2026-10-02T04:57:32Z",
    "state": "PUBLISHED",
    "vulnId": "GCVE-1988-2026-0404"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}