Vulnerability · Published Sep 8, 2026 · Assigned by sap

CVE-2026-44756Memory Corruption vulnerability in SAP Extended Passport (EPP) Processing

Critical 10.0

In plain English

A critical-severity buffer overflow in SAP Extended Passport (EPP) Processing from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 73% of all known vulnerabilities).

Severity (CVSS 3.1)10.0Critical

Exploit odds (30 days)1.4%top 27.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditions, an unauthenticated attacker could exploit a crafted network request containing a malformed EPP header, potentially resulting in undefined behavior and abnormal program termination. Successful exploitation may have a high impact on the confidentiality, integrity, and availability of the application.

Affected products (as reported)

Vendor	Product	Versions
SAP_SE	SAP Extended Passport (EPP) Processing	KRNL64NUC 7.227.22EXTKRNL64UC 7.227.538.04WEBDISP 9.169.189.19

Weakness: CWE-120 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

In plain English

Official description

Affected products (as reported)

References