CVE-2026-44756

criticalPriorität · verfolgen · 40EPSS 0.014 · 72. PerzentilNL

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

1.40% (72nd) EPSS

CVSS 10 · critical

Is it mine?

20 products

Prüfe deine Angriffsfläche

Who says so?

1 sources

ncsc_nl

EPSS · bewertet 2026-10-27

A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditions, an unauthenticated attacker could exploit a crafted network request containing a malformed EPP header, potentially resulting in undefined behavior and abnormal program termination. Successful exploitation may have a high impact on the confidentiality, integrity, and availability of the application.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

10.0

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hprimary · cna@sap.comAusnutzbarkeit 3.9 · Auswirkung 6

v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

v3.110criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:Hsecondary · NCSC-NL NL

SSVC

Eine Handlungsentscheidung — aus Ausnutzung und Auswirkung.

Exploitation: none · Automatable: yes · Technical Impact: totalcoordinatorcisa_ssvcUS

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-120USCWE-120US

betroffene Produkte (20)

Betroffene Produkte und Versionsbereiche.

SAP Content Server, Internet Communication Manager, Web Dispatcher≤ vers:unknown/*ncsc_nlNL
SAP Extended Passport Processing≤ vers:unknown/*ncsc_nlNL
SAP GUI for Java≤ vers:unknown/*ncsc_nlNL
SAP Integration Suite≤ vers:unknown/*ncsc_nlNL
SAP Manufacturing Integration and Intelligence≤ vers:unknown/*ncsc_nlNL
SAP NetWeaver≤ vers:unknown/*ncsc_nlNL
SAP NetWeaver Business Client≤ vers:unknown/*ncsc_nlNL
SAP NetWeaver Message Server≤ vers:unknown/*ncsc_nlNL
SAP S4HANA≤ vers:unknown/*ncsc_nlNL
SAP SAP Software≤ vers:unknown/*ncsc_nlNL
SAP_SE SAP ABAP Developer Tools≤ vers:unknown/*ncsc_nlNL
SAP_SE SAP Cloud Application Programming Model (CAP)≤ vers:unknown/*ncsc_nlNL
SAP_SE SAP Extended Passport (EPP) Processing≤ vers:unknown/*ncsc_nlNL
SAP_SE SAP Integration Suite≤ vers:unknown/*ncsc_nlNL
SAP_SE SAP Manufacturing Integration and Intelligence≤ vers:unknown/*ncsc_nlNL
SAP_SE SAP NetWeaver (Message Server)≤ vers:unknown/*ncsc_nlNL
SAP_SE SAP NetWeaver (SAP GUI for Java)≤ vers:unknown/*ncsc_nlNL
SAP_SE SAP NetWeaver Business Client≤ vers:unknown/*ncsc_nlNL
SAP_SE SAP S/4HANA (Intercompany Matching and Reconciliation)≤ vers:unknown/*ncsc_nlNL
SAP_SE SAP Web Dispatcher, Internet Communication Manager and SAP Content Server≤ vers:unknown/*ncsc_nlNL

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

NCSC-2026-0356Kwetsbaarheden verholpen in diverse SAP-productenNL2026-09-09csaf · ncsc_nlNL
SAP heeft kwetsbaarheden verholpen in SAP Extended Passport Protocol (EPP) processing library, SAP NetWeaver Message Server, @sap/cds-mtxs NPM library, SAP GUI for Java, SAP ABAP Development Tools voor SAP NetWeaver AS ABAP, SAP Integration Suite, SAP NetWeaver Business Client, SAP Web Dispatcher, Internet Communication Manager, SAP Content Server, SAP S/4HANA Intercompany Matching and Reconciliation module, en SAP Manufacturing Integration and Intelligence.

quellen

Welche Quellen diesen Datensatz belegen und wann.

ncsc_nl NVD CVE.org MITRE

veröffentlicht 2026-09-08geändert 2026-09-22

Referenzen (3) nvd

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan