Critical SAP Kernel Flaw CVE-2026-44756 Allows Pre-Auth Remote Code Execution

·1 views

A maximum-severity vulnerability dubbed OVERPASS (CVE-2026-44756, CVSS 10.0) has been disclosed in the SAP Kernel, affecting products including SAP NetWeaver AS ABAP, SAP Web Dispatcher, and SAP S/4HANA. The flaw is a buffer overflow in Extended Passport (EPP) processing that can be triggered before any authentication takes place, allowing attackers to execute arbitrary OS commands with SAP administrative privileges. It is exploitable remotely over HTTP(S), SAP GUI, or RFC, requiring no valid SAP account or user interaction. SAP addressed the issue through Security Note 3747649, published on its September 2026 Security Patch Day, and urges organizations to prioritize patching internet-facing systems first. Until patches are applied, SAP recommends restricting access via SAProuter, jump hosts, and Web Dispatcher, while monitoring for application-layer anomalies and suspicious SAP process activity.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

AI Amplifies Senior Engineers Rather Than Replacing Them, Experts Say

The rise of large language models has triggered a structural shift in software engineering, boosting productivity and enabling lean teams — sometimes just a single founder — to build scalable products. Tools like Claude have removed code-writing as the primary bottleneck, shifting the real competitive edge toward system design, architecture, and complex integration. While some senior engineers feel uncertain about their relevance, industry observers argue this view is incomplete. Experienced professionals are considered more valuable than ever, as skills like sustainable architecture design, production reliability, and global-scale operations are amplified — not replaced — by AI. In precision-driven sectors such as banking and fintech, senior engineers who already operate at a high level stand to benefit most from these new capabilities.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Free Email Signature Generator After Fighting Outlook Rendering Issues

A developer named Nikolay has released SimpleSignature, a free email signature generator built from years of experimenting with pure CSS icons dating back to 2017. While applying CSS icon techniques to an email signature at his most recent job, he encountered significant rendering challenges with Classic Outlook, including spacing quirks and inconsistent behaviour across email clients. One notable workaround he discovered was using line-height: 0.5pt to effectively eliminate unwanted spacing in Classic Outlook. The tool requires no registration and does not store any user data. SimpleSignature is available for free at nikolaisabev.eu/SimpleSignature, with the developer welcoming feedback and bug reports from users.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why WPF ScrollViewer Fails to Scroll Inside StackPanel and How to Fix It

A common WPF issue causes ScrollViewer to display no scrollbar when placed inside a vertical StackPanel, even with VerticalScrollBarVisibility set to Auto. The root cause is that StackPanel passes infinite available height to its children during layout measurement, so ScrollViewer never detects an overflow and expands to match its full content height. This results in ScrollableHeight being zero and the scrollbar remaining hidden, regardless of how many items the control contains. The fix is to place ScrollViewer inside a container that enforces a finite height constraint, such as a Grid row sized with a star value, a DockPanel using LastChildFill, or by assigning an explicit Height or MaxHeight directly to the ScrollViewer. Once a real height constraint is passed down, the ScrollViewer correctly calculates overflow and renders a functional scrollbar.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer builds GitHub Action that auto-explains CI failures in plain English

A developer named Gopalcnepal has built explain-ci, a GitHub Action that reads failed CI job logs and automatically posts a plain-English explanation as a pull request comment. The tool runs as a separate job after a failure, since the failed job's log is only queryable via API once that job has completed. Users must supply their own API key, and the action supports multiple AI providers including OpenAI, Gemini, Claude, Groq, and Mistral, as well as self-hosted Ollama instances for privacy-sensitive environments. During development, the creator discovered two bugs — one involving over-aggressive log redaction and another stemming from test inputs that did not reflect real-world data. The project is open source under the MIT license and is available on the GitHub Marketplace.

0 comments Read more at DEV Community