by Kastro
Paper/Archive/CVE-2026-44756

CVE-2026-44756

SAP_SE SAP Extended Passport (EPP) Processing — Memory Corruption vulnerability in SAP Extended Passport (EPP) Processing

EPSS 1%CVSS 10.0
critical.is priorityof 100
45
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 72.5.725 × 2014.5No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditions, an unauthenticated attacker could exploit a crafted network request containing a malformed EPP header, potentially resulting in undefined behavior and abnormal program termination. Successful exploitation may have a high impact on the confidentiality, integrity, and availability of the application.

Affected

ProductAffectedFixed inSource
SAP Extended Passport (EPP) ProcessingKRNL64NUC 7.22–CNA
SAP Extended Passport (EPP) Processing7.22EXT–CNA
SAP Extended Passport (EPP) ProcessingKRNL64UC 7.22–CNA
SAP Extended Passport (EPP) Processing7.53–CNA
SAP Extended Passport (EPP) Processing8.04–CNA
SAP Extended Passport (EPP) ProcessingWEBDISP 9.16–CNA
SAP Extended Passport (EPP) Processing9.18–CNA
SAP Extended Passport (EPP) Processing9.19–CNA
SAP Extended Passport (EPP) Processing9.20–CNA
SAP Extended Passport (EPP) ProcessingKERNEL 7.22–CNA
SAP Extended Passport (EPP) Processing7.54–CNA
SAP Extended Passport (EPP) Processing7.77–CNA

Scores by source

sap (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refme.sap.com/notes/3747649refurl.sap/sapsecuritypatchdayrefseclists.org/fulldisclosure/2026/Sep/65