SAP warns of maximum severity 'OVERPASS' kernel vulnerability

SAP patched CVE-2026-44756, a CVSS 10.0 memory corruption flaw in Extended Passport processing, codenamed OVERPASS. Discovered by Onapsis, it allows unauthenticated remote attackers to run OS commands with SAP administrative privileges. SAP also fixed CVE-2026-58240, a 9.8-rated NetWeaver Message Server authentication flaw.