SAP OVERPASS Update: New Attack Route and Public Exploit Code Raise Patching Stakes

Researchers have identified another route to SAP’s OVERPASS vulnerability, while exploit code tied to the flaw has surfaced in a public SAP discovery and exploitation toolkit, according to an advisory from Layer Seven Security. The developments give SAP teams new exposure paths to account for as they patch affected systems.

SAP disclosed OVERPASS, tracked as CVE-2026-44756, during its September Security Patch Day. The flaw carries a CVSS score of 10.0, affects shared SAP Kernel code, and can allow an unauthenticated attacker to execute commands on an affected server. SAP Security Note 3747649 contains the corrections.

The new research shows that temporary protections can leave some communication routes open. SAP cybersecurity teams now need to understand which paths still reach vulnerable components while remediation is underway.

What Changed With the SAP OVERPASS Vulnerability

OVERPASS affects the part of the SAP Kernel that processes Extended Passport data, a tracing record attached to requests as they move between systems. SAP processes that data before authentication, allowing an attacker to reach the vulnerable code without first logging in.

Layer Seven Security reports that researchers have demonstrated attack paths through web traffic, SAP GUI, and RFC, the protocol SAP systems use to communicate with one another. The newest route uses Next Generation RFC, a WebSocket-based version of the protocol that can travel over HTTPS through SAP Web Dispatcher before reaching the affected system.

That route affects teams that limited exposure by restricting traditional RFC traffic. Those controls do not cover the WebSocket-based route, so each communication path needs to be evaluated separately while remediation continues.

Exploit code has also become easier to obtain. Layer Seven Security says proof-of-concept code for OVERPASS was found in the repository history of SAPMAP, a public SAP discovery and exploitation toolkit. The advisory does not report active exploitation, but it advises defenders to assume copies of the code are publicly available.

Why Temporary Fixes Leave Some SAP Paths Exposed

SAP’s temporary workaround, described in Security Note 3756304, removes Extended Passport data from web requests at SAP Web Dispatcher. It works only when web traffic passes through that component, so teams also need to prevent direct connections that bypass it.

The workaround covers that web route alone. Layer Seven Security notes that SAP GUI, traditional RFC, and WebSocket-based RFC traffic still carry Extended Passport data, and those paths need separate controls until affected systems are patched.

Filtering has side effects. It removes information SAP teams use to trace requests and diagnose problems, while the backend may also lose evidence that a suspicious request reached the system. Layer Seven Security recommends recording relevant traffic before it is filtered so investigators retain evidence to examine.

Closing the remaining paths requires different restrictions across SAP GUI, RFC, web access, and system connections. The work can span network, SAP Basis, and security teams, leaving organizations with a coordination problem: knowing which systems remain exposed and whether the appropriate controls are actually in place.

How Layer Seven Security Maps Remaining OVERPASS Exposure

Layer Seven Security approaches the remaining exposure by connecting vulnerable systems with the routes around them. The company’s Cybersecurity Extension for SAP identifies affected components and the Kernel and Web Dispatcher versions that still need correction. It also checks the controls around those systems, including access restrictions on different communication paths and whether traffic can bypass the Web Dispatcher.

The product also maps trusted RFC connections, which matter after an initial compromise. A trusted connection gives one SAP system established access to another, so the risk around a vulnerable server depends partly on which systems trust it and how those links are configured. Layer Seven Security says it combines those relationships with network exposure and security settings to support remediation prioritization.

Detection covers the same environment. The product monitors for unusual Extended Passport traffic, abnormal WebSocket activity, and operating-system commands run by SAP service accounts.

The Cybersecurity Extension runs inside SAP as an SAP-certified add-on and analyzes SAP-specific configuration and logs as part of those checks. This brings vulnerability status, system connections, and suspicious activity into one view that network, SAP Basis, and security teams can use while patches are deployed.

What This Means for SAPinsiders

• Map exposure before setting the patch order. OVERPASS risk depends on how vulnerable systems are connected and which routes remain open. Linking patch status with trusted connections and network exposure helps teams focus first on systems that are easiest to reach.
• Match temporary controls to each protocol. The HTTP workaround does not protect SAP GUI, traditional RFC, or WebSocket-based RFC traffic. Evaluating those paths separately gives teams a clearer picture of where interim protection still has gaps.
• Preserve visibility while reducing exposure. Filtering Extended Passport data can remove evidence that a suspicious request reached the backend. Capturing that activity earlier in the traffic path gives investigators useful records while temporary protections remain in place.