Unauthenticated RCE Flaw Found in SAP Kernel EPP
An unauthenticated remote code execution flaw in SAP's Extended Passport (EPP) kernel processing (CVE-2026-44756) affects widely deployed SAP components; no in-the-wild exploitation reported yet.
MS-ISAC has issued an advisory covering CVE-2026-44756, a vulnerability discovered by Onapsis in SAP's Extended Passport (EPP) Processing — a core kernel-level tracing/logging mechanism automatically created for every SAP session and propagated across RFC and HTTP communications between distributed SAP and non-SAP systems. Because EPP handling is shared kernel code, the flaw is reachable through three separate access vectors: the web layer (ICM/Web Dispatcher powering Fiori, WebGUI, and public-facing APIs), the classic SAP GUI layer (via the SAP Dispatcher), and the RFC layer used for system-to-system and third-party integrations. The root cause is a missing boundary check during deserialization of EPP data, allowing an attacker to send a malformed EPP header with an externally supplied length field, triggering a memory safety violation and undefined behavior.
Exploitation requires no authentication and could allow a remote attacker to execute arbitrary OS commands on the SAP host with SAP administrative privileges, resulting in full compromise of underlying business data and processes. The vulnerability exists by default across a broad range of SAP kernel and Web Dispatcher versions (KRNL64NUC/KRNL64UC 7.22-8.04, WEBDISP 9.16-9.20, KERNEL 7.22-9.20). No public reports of in-the-wild exploitation exist at this time, but given the default presence of the vulnerable code across nearly all SAP deployments and multiple internet-reachable entry points, organizations should prioritize patching.
Defenders should apply SAP's official patches immediately after testing, restrict and monitor exposure of ICM/Web Dispatcher and RFC interfaces (especially internet-facing ones), enforce least-privilege on SAP service accounts, and use network segmentation/DMZ controls to limit direct internet access to SAP application layers. Vulnerability scanning and penetration testing focused on SAP GUI, RFC, and web-facing components are recommended to validate remediation.
Mentioned in this report
Detection guidance
Malformed EPP Header Injection via Network Traffic
Detects network connections to SAP ICM/Web Dispatcher or RFC ports with suspiciously short payloads followed by protocol anomalies, suggestive of EPP deserialization exploitation attempts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Malformed EPP Header Injection via Network Traffic
description: Detects inbound traffic to SAP ICM, Web Dispatcher, or RFC listener ports
exhibiting early connection termination or truncated protocol frames consistent
with malformed EPP header injection attacks targeting the deserialization vulnerability.
tags:
- attack.t1190
- attack.reconnaissance
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationPort:
- 3200
- 3201
- 3300
- 3301
- 8000
- 8001
- 50000
- 50001
filter_legitimate:
Image|endswith:
- \disp+work.exe
- \icm.exe
- \gwrd.exe
condition: selection and not filter_legitimate
falsepositives:
- Network scanning tools probing SAP ports for availability
- Monitoring/health-check utilities performing port connectivity tests
level: medium
id: ecc47c69-6172-5ddc-83bd-458aeff53a67
status: experimental
author: Vorant
SAP RFC or ICM Process Abnormal Memory Access Pattern
Detects SAP dispatcher, icm, or gwrd processes triggering access violations or segmentation faults, indicative of memory boundary check bypass during EPP deserialization. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SAP RFC or ICM Process Abnormal Memory Access Pattern
description: Detects SAP kernel processes (disp+work, icm, gwrd) terminated by memory
access violations or segmentation faults, consistent with missing boundary checks
in EPP deserialization leading to undefined behavior.
tags:
- attack.t1190
- attack.impact
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- \disp+work.exe
- \icm.exe
- \gwrd.exe
CommandLine|contains:
- 'status: ACCESS_VIOLATION'
- 'exit code: 0xc0000374'
- 'exit code: 0xc0000005'
condition: selection
falsepositives:
- Kernel crash dumps generated during SAP patching or upgrade cycles
- Intentional stress-testing of SAP kernel robustness by internal testing teams
level: medium
id: f394e738-16a3-5628-b259-35285c4b5d3d
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-sap-extended-passport-epp-processing-could-allow-for-remote-code-execution_2026-092
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free