SAP CVSS 10.0: an unauthenticated crash in Web Dispatcher

SAP's September Security Patch Day landed today with 19 new security notes plus one update, and the top of the list is a CVSS 10.0. CVE-2026-44756 is a memory corruption flaw in SAP Extended Passport (EPP) processing, and it sits in the SAP Kernel and in Web Dispatcher — the component you deliberately put in front of everything else. No credentials required. If you run SAP anywhere, this is the note to read first.

What actually happened

Per SAP's own patch day listing, Note 3747649 carries the 10.0 and covers KRNL64NUC 7.22 and 7.22EXT, KERNEL 7.22 through 9.20, and WEBDISP 9.16 through 9.20. Extended Passport is SAP's request-tracing header — plumbing that rides along on normal traffic. An unauthenticated attacker sends a malformed protocol header in a crafted request and triggers memory corruption, producing undefined behaviour or a hard process termination.

Three more critical notes shipped alongside it:

• Note 3759472 (CVSS 9.8) — missing authentication check in NetWeaver Message Server, KERNEL 9.16 to 9.20
• Note 3798315 (CVSS 9.4) — credential disclosure in multitenant apps on the Cloud Application Programming model, in @sap/cds-mtxs up to 4.0.2
• Note 3781729 (CVSS 9.0) — improper access control in SAP GUI for Java, BC-FES-JAV 8.10

SAP reports no confirmed in-the-wild exploitation and no public proof-of-concept as of publication, and Onapsis Research Labs contributed to the analysis. "No PoC yet" is a timestamp, not a status.

Why this SAP patch matters for your business

Web Dispatcher is the reason this is a 10.0 and not a 7. Message Server and the Kernel usually sit behind something. Web Dispatcher is the something. It is the reverse proxy you exposed on purpose, which means an unauthenticated header parse bug there is reachable from the internet by design. Find your Web Dispatcher version before you find your patch window.

Availability is the impact here, and people undercount it. The described outcome is memory corruption and process termination — a crash, not a confirmed shell. Teams read that and downgrade the urgency. A repeatable unauthenticated crash of the component that fronts your ERP is a denial-of-service primitive anyone can fire in a loop, and memory corruption in a C-family parser is the kind of bug that gets a better write-up two months later.

Kernel patching means downtime, so schedule it today. This is not a config toggle. Kernel and Web Dispatcher updates mean a binary swap and a restart, which means a change window, which means the calendar is the bottleneck. We watched the same compression on SAP Commerce Cloud in August, where exploitation showed up three days after the fix. Book the window now and move it later if you must.

Patch by exploitability, not by note count. Nineteen notes will produce a spreadsheet and a stalled meeting. Four of them are 9.0 or higher and one is remotely reachable without a login. That is your list. Everything else is next sprint — the same triage-by-exploitation discipline we apply to any large advisory drop.

Sources: SAP Security Notes — September 2026, SecurityOnline.