SAP Patches Critical Extended Passport Processing Vulnerability
Affecting the SAP kernel code, the flaw allows unauthenticated, remote attackers to run arbitrary commands, recover secrets, and modify data. The post SAP Patches Critical Extended Passport Processing Vulnerability appeared first on SecurityWeek.
SAP released 20 new and updated security notes on Tuesday, including one that resolves a critical-severity memory corruption vulnerability.
Tracked as CVE-2026-44756 (CVSS score of 10/10), the critical bug is described as a memory corruption issue in Extended Passport (EPP) Processing.
Missing boundary validations during the deserialization of EPP data could trigger unsafe memory behavior during the processing of externally supplied length fields, application security firm Onapsis explains.
Source: https://www.securityweek.com/sap-patches-critical-extended-passport-processing-vulnerability/
Related breach coverage
- Critical Ruby on Rails Vulnerability in Attackers’ Crosshairs2026-08-31
Named KindaRails2Shell, the arbitrary file read flaw allows attackers to extract secrets and execute arbitrary code remotely. The post Critical Ruby on Rails Vulnerability in Attackers’ Crosshairs appeared first on SecurityWeek.
- GitLab Patches Critical Code Injection Vulnerability2026-08-18
The security defect allows unauthenticated attackers to modify or delete user data and public projects. The post GitLab Patches Critical Code Injection Vulnerability appeared first on SecurityWeek.
- GitLab Vulnerability Exploited One Day After Disclosure2026-09-11
The critical-severity path traversal flaw allows unauthenticated attackers to read arbitrary files from the GitLab server. The post GitLab Vulnerability Exploited One Day After Disclosure appeared first on SecurityWeek.
- Hackers Start Exploiting Critical Langflow Vulnerability2026-09-01
Tracked as CVE-2026-0768, the security defect allows unauthenticated attackers to execute arbitrary Python code remotely. The post Hackers Start Exploiting Critical Langflow Vulnerability appeared first on SecurityWeek.