CVE-2026-44756: Critical SAP Kernel Flaw Enables Unauthenticated Remote Code Execution

**CVE-2026-44756 (OVERPASS)** is a critical (CVSS 10.0) memory-corruption vulnerability in SAP Extended Passport Processing that permits unauthenticated remote attackers to send malformed EPP headers causing unsafe memory behavior and potential arbitrary OS command execution across many SAP products using shared kernel code; SAP released Security Note 3747649 (Sept 8, 2026) and immediate kernel patching of internet-facing and internal systems is strongly recommended, with monitoring for anomalous SAP requests and abnormal OS-level activity during remediation.