CVE-2026-44756: Pre-Auth RCE in SAP EPP Processing (ICM, Web Dispatcher, disp+work)

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-09-22 18:31 UTC
Importiert: 2026-09-27 04:21 UTC
CVSS: 10.0
Quelle-ID: full_disc
uid_hash: 3231d850e4dec48cb8a5769a6e3944ec3f8915e8c45d83a5eb81e18f227f62ef

Full Disclosure

Posted by Raschin Tavakoli via Fulldisclosure on Sep 22 nullFaktor Security Advisory < 2026-09-10 >

===========================================================

Title: Pre-Authentication Remote Code Execution in SAP

                  Extended Passport (EPP) processing library

Affected Components: ICM, SAP Web Dispatcher, dialog work processes

Vulnerability: Stack based Buffer Overflow

CVE: CVE-2026-44756

Impact: Critical

CVSS 4.0 Vector:...

CVE-ID	Severity (Quelle)	CVSS (Quelle)	Severity (CVE.org)	CVSS (CVE.org)	EPSS	EPSS-Pctl	Veroeffentlicht (CVE.org)
CVE-2026-44756	CRITICAL	10	CRITICAL	10	0.01399	0.7209	2026-09-08

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
Full Disclosure	full_disc	threat_intel		-	de	https://seclists.org/rss/fulldisclosure.rss