SAP EPP EUVD-2026-72572

Exploitation requires network access to a SAP service that ingests and parses Extended Passport (EPP) headers, and the ability to send a crafted request carrying a malformed EPP header; no authentication or user interaction is needed per the CVSS vector (PR:N/UI:N). Exploitation is limited by the description's own qualifier that it succeeds only 'under specific conditions,' implying the malformed input must hit a particular code path or configuration state, which raises real attack complexity above the vendor's AC:L rating. The primary demonstrated effect is a crash/abnormal termination; higher confidentiality/integrity impact is stated only as a possibility.

The vendor CVSS is a maximal 10.0 (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), which on paper signals a top-priority, wormable-class flaw. However, the description itself is more measured than the score: it emphasizes 'undefined behavior and abnormal program termination' (a crash / availability impact) and hedges confidentiality and integrity with 'potentially' and 'may,' and it states exploitation occurs only 'under specific conditions' - which conflicts with the AC:L rating and suggests real-world attack complexity is higher than advertised. That gap means the confirmed impact is availability (DoS of the SAP service), while the C:H/I:H claims and the scope-change (S:C) appear aspirational for a memory-safety bug that could in principle be escalated to code execution but is not described as doing so. There is no EPSS figure, no POC, and no KEV listing in the provided data, so there is no evidence of active exploitation; the priority here derives from the unauthenticated network reachability and SAP's ubiquity in high-value enterprise environments rather than from proven weaponization. Given that SAP systems process business-critical data, defenders should still treat unauthenticated, network-facing SAP EPP exposure as an urgent patch item - a mid-sized enterprise or municipal SAP operator should not wait for a public exploit before applying SAP Note 3747649.

An attacker with network reachability to an exposed SAP service crafts a single request containing a malformed EPP header with an oversized or malformed field, sends it without authentication, and overruns a buffer in the EPP parsing library, crashing the SAP process and causing a denial of service; with further effort the memory corruption could potentially be developed toward code execution. No public exploit code is identified at time of analysis.