Unauthenticated RCE Flaw Found in SAP Kernel EPP
An unauthenticated remote code execution flaw in SAP's Extended Passport (EPP) kernel processing (CVE-2026-44756) affects widely deployed SAP components; no in-the-wild exploitation reported yet.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
MS-ISAC has issued an advisory covering CVE-2026-44756, a vulnerability discovered by Onapsis in SAP's Extended Passport (EPP) Processing — a core kernel-level tracing/logging mechanism automatically created for every SAP session and propagated across RFC and HTTP communications between distributed SAP and non-SAP systems. Because EPP handling is shared kernel code, the flaw is reachable through three separate access vectors: the web layer (ICM/Web Dispatcher powering Fiori, WebGUI, and public-facing APIs), the classic SAP GUI layer (via the SAP Dispatcher), and the RFC layer used for system-to-system and third-party integrations. The root cause is a missing boundary check during deserialization of EPP data, allowing an attacker to send a malformed EPP header with an externally supplied length field, triggering a memory safety violation and undefined behavior.
Exploitation requires no authentication and could allow a remote attacker to execute arbitrary OS commands on the SAP host with SAP administrative privileges, resulting in full compromise of underlying business data and processes. The vulnerability exists by default across a broad range of SAP kernel and Web Dispatcher versions (KRNL64NUC/KRNL64UC 7.22-8.04, WEBDISP 9.16-9.20, KERNEL 7.22-9.20). No public reports of in-the-wild exploitation exist at this time, but given the default presence of the vulnerable code across nearly all SAP deployments and multiple internet-reachable entry points, organizations should prioritize patching.
Defenders should apply SAP's official patches immediately after testing, restrict and monitor exposure of ICM/Web Dispatcher and RFC interfaces (especially internet-facing ones), enforce least-privilege on SAP service accounts, and use network segmentation/DMZ controls to limit direct internet access to SAP application layers. Vulnerability scanning and penetration testing focused on SAP GUI, RFC, and web-facing components are recommended to validate remediation.
Mentioned in this report
Detection guidance
Malformed EPP Header Injection via Network Traffic
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects network connections to SAP ICM/Web Dispatcher or RFC ports with suspiciously short payloads followed by protocol anomalies, suggestive of EPP deserialization exploitation attempts. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Malformed EPP Header Injection via Network Traffic
description: Detects inbound traffic to SAP ICM, Web Dispatcher, or RFC listener ports
exhibiting early connection termination or truncated protocol frames consistent
with malformed EPP header injection attacks targeting the deserialization vulnerability.
tags:
- attack.t1190
- attack.reconnaissance
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationPort:
- 3200
- 3201
- 3300
- 3301
- 8000
- 8001
- 50000
- 50001
filter_legitimate:
Image|endswith:
- \disp+work.exe
- \icm.exe
- \gwrd.exe
condition: selection and not filter_legitimate
falsepositives:
- Network scanning tools probing SAP ports for availability
- Monitoring/health-check utilities performing port connectivity tests
level: medium
id: ecc47c69-6172-5ddc-83bd-458aeff53a67
status: experimental
author: Vorant
SAP RFC or ICM Process Abnormal Memory Access Pattern
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects SAP dispatcher, icm, or gwrd processes triggering access violations or segmentation faults, indicative of memory boundary check bypass during EPP deserialization. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SAP RFC or ICM Process Abnormal Memory Access Pattern
description: Detects SAP kernel processes (disp+work, icm, gwrd) terminated by memory
access violations or segmentation faults, consistent with missing boundary checks
in EPP deserialization leading to undefined behavior.
tags:
- attack.t1190
- attack.impact
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- \disp+work.exe
- \icm.exe
- \gwrd.exe
CommandLine|contains:
- 'status: ACCESS_VIOLATION'
- 'exit code: 0xc0000374'
- 'exit code: 0xc0000005'
condition: selection
falsepositives:
- Kernel crash dumps generated during SAP patching or upgrade cycles
- Intentional stress-testing of SAP kernel robustness by internal testing teams
level: medium
id: f394e738-16a3-5628-b259-35285c4b5d3d
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-sap-extended-passport-epp-processing-could-allow-for-remote-code-execution_2026-092
Free public brief. The indicators and the detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs