SAP’s September patch day put a 10.0 on a flaw its own record describes as a crash, and a 9.8 on one its own record describes as an attacker registering a rogue application server.
What happened
SAP released its September 2026 Security Patch Day on Tuesday, September 8. Seventeen CVE records carrying SAP’s CNA identifier, [email protected], entered the National Vulnerability Database in a single batch at 1:17 a.m. UTC that morning. Two of them sit in the SAP kernel, and the pair is worth reading side by side.
The higher-scored of the two is CVE-2026-44756, covered by SAP Note 3747649. SAP’s description of it reads, in full: “A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditions, an unauthenticated attacker could exploit a crafted network request containing a malformed EPP header, potentially resulting in undefined behavior and abnormal program termination.” The assigned weakness is CWE-120, buffer copy without checking the size of input.
SAP scored it CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H — a base score of 10.0, the maximum the framework produces.
The second is CVE-2026-58240, covered by SAP Note 3759472, in the NetWeaver Message Server. SAP’s description: “SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially perform unauthorized actions within the application environment, resulting in a high impact on the confidentiality, integrity, and availability of the affected system.” The weakness is CWE-308, use of single-factor authentication.
SAP scored that one CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — 9.8.
Every metric in the two vectors is identical except one. Attack vector, attack complexity, privileges required, user interaction, and all three impact metrics match. The only difference is scope: S:C on the Extended Passport flaw, S:U on the Message Server flaw. That single character is the entire 0.2 separating them. Strip the scope change from CVE-2026-44756 and it scores 9.8, the same as the other.
The affected lists are release names, not patch levels. CVE-2026-44756 names KRNL64NUC 7.22 and 7.22EXT, KRNL64UC 7.22, KERNEL 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, and 8.04, and WEBDISP 9.16, 9.18, 9.19, and 9.20. CVE-2026-58240 names KERNEL 9.16, 9.18, 9.19, and 9.20. Neither record carries a fixed version, a solution field, or a workaround. Each has exactly two references: the SAP note, and the generic patch day landing page at url.sap/sapsecuritypatchday. An unauthenticated fetch of me.sap.com/notes/3747649 returned no readable content — SAP notes require an S-user login, so the patch level that actually closes either flaw is not publicly stated anywhere.
Both records were in NVD status “Received” as of Tuesday morning, meaning NVD had not analyzed them: no CPE data, no NVD-assigned score, and no CISA-ADP secondary score. SAP’s own numbers are the only numbers.
Why it matters
Scope is the CVSS v3.1 metric with the least agreement behind it. The specification defines a scope change as an impact that crosses a security authority boundary — the vulnerable component and the impacted component are not the same. In practice, different CNAs read that boundary differently, and there is no test that settles it. It is also the metric with the largest single effect on the final number, which is why it ends up carrying arguments that are really about something else.
Here the argument is visible in the prose. SAP’s description of CVE-2026-44756 stops at “undefined behavior and abnormal program termination.” That is a crash. A crash supports A:H. It does not, on its own text, support C:H or I:H, let alone a scope change that lifts the total to a perfect 10.0. CWE-120 makes the full-compromise reading plausible — a buffer copy without a length check is the canonical path from crash to controlled write to code execution — but the record does not say that. It says the program terminates abnormally.
Meanwhile the record that does describe a full compromise in plain words, where an unauthenticated attacker registers an unauthorized application server component and gets high confidentiality, integrity, and availability impact, is the one scored lower. Read the two descriptions with the scores hidden and most readers would rank them the other way around.
This is not a pedantic complaint, because almost nothing downstream reads the prose. Vulnerability scanners ingest the vector. Ticketing systems sort on the base score. Patch windows are negotiated against a number, and a 10.0 wins that negotiation against a 9.8 every time, in every organization, without anyone opening the record. The team that patches by score patches the described crash first and the described takeover second.
The Message Server flaw also has more history behind it than its score suggests. The message server is the component SAP application server instances register with to find each other; its internal port is meant to be reachable only from the application server subnet, and the access control list governing which hosts may register has been the subject of SAP guidance for years. CWE-308 — single-factor authentication — is the CNA saying the registration handshake proves less than it should. An attacker who can reach that port and register as an application server is inside the trust boundary of the system, not knocking on it.
The second problem is the one Severity Daily keeps finding across vendors: the record tells you what is broken and refuses to tell you what fixes it. SAP kernels are versioned by release and patch level, and the patch level is the only thing that matters for remediation. The CVE record gives the release. The patch level lives in the note, and the note is behind a customer login. For an SAP customer with an S-user, this is a mild annoyance. For everyone else who has to reason about SAP exposure — an auditor, an acquirer running diligence, a managed service provider, a security team asked whether the vendor in its supply chain is patched — the public record stops one field short of useful.
What to do
Both fixes are kernel patches, not application patches, and both need an S-user to retrieve. Read SAP Note 3747649 for the Extended Passport flaw and SAP Note 3759472 for the Message Server flaw, and take the target patch level from the note rather than from any secondary summary.
Prioritize by exposure, not by the two-tenths between the scores. For CVE-2026-44756, the affected list includes WEBDISP 9.16 through 9.20 — SAP Web Dispatcher is the reverse proxy many organizations place at the internet edge in front of an SAP landscape, which makes it the instance of this kernel most likely to be reachable by an unauthenticated attacker. Inventory Web Dispatcher separately from the ABAP and Java stacks; it is often patched on a different cadence and by a different team.
For CVE-2026-58240, confirm which hosts can currently reach the message server’s internal port. As general practice rather than vendor instruction, that port should be reachable only from the application server subnet, and the registration ACL should be an explicit allowlist rather than a default. If reachability is broader than that today, narrowing it is worth doing while the kernel patch is being scheduled — it does not fix the validation weakness, but it shrinks the set of hosts that can attempt the registration.
Do not treat the 10.0 as evidence of remote code execution when talking to leadership or to auditors. The honest statement is that SAP scored it 10.0, that SAP’s own description of the outcome stops at abnormal termination, that the weakness class is consistent with worse, and that no exploitation has been reported.
Sourcing note
Checked: the NVD API records for CVE-2026-44756 and CVE-2026-58240, and the authoritative CVE records from the CVE Program’s own API at cveawg.mitre.org for both, which agree on descriptions, vectors, CWEs, affected version lists, and the absence of any fixed version or solution field. Both records were published September 8, 2026 at 1:17 a.m. UTC, source [email protected], status “Received.”
Could not reach: SAP’s own Security Patch Day page at support.sap.com, which is disallowed to automated fetching by its robots file, and SAP Note 3747649 at me.sap.com, which returned no readable content without a customer login. Secondary coverage of the patch day describes 19 notes in total; this page counts only the 17 SAP-CNA CVE records observed entering NVD in the September 8 batch, and does not assert a note total. Two CVEs named in secondary coverage, CVE-2026-58243 and CVE-2026-2332, were not present in that NVD window and are not described here.
Unresolved: whether CVE-2026-44756 is exploitable beyond a denial of service. SAP’s description says termination; SAP’s vector says confidentiality, integrity, and availability with a scope change. The record does not reconcile the two, and SAP has published no exploitability statement in the public record. No exploitation of either flaw has been reported, and neither appears in CISA’s Known Exploited Vulnerabilities catalog as of this writing. NVD had not completed analysis of either record, so there is no independent score to compare against SAP’s.