Critical severity · published Jun 9, 2026
CVE-2026-44748
XML Signature Wrapping in SAML Authentication in SAP NetWeaver AS ABAP and ABAP Platform
9.9
CVSS
0.2%
EPSS
No
On KEV
Description
SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modified signed XML documents to the verifier. This may result in acceptance of tampered identity information leading to unauthorized access to sensitive user data and potential disruption of normal system usage. This causes a high impact on confidentiality, integrity and availability of the application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 14% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
SN
SAP NetWeaver AS ABAP and ABAP Platform · SAP_SE
SAP_BASIS 702; SAP_BASIS 731; SAP_BASIS 740; SAP_BASIS 750; SAP_BASIS 751; SAP_BASIS 752; +9 more · source: vendor
Affected product
SN
SAP NetWeaver AS ABAP and ABAP Platform
SAP_SE
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-44748
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-44748
me.sap.com
https://me.sap.com/notes/3746332
url.sap
https://url.sap/sapsecuritypatchday
More from SAP NetWeaver AS ABAP and ABAP Platform
9.8
CVE-2026-27671
Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform
8.8
CVE-2026-23687
XML Signature Wrapping in SAP NetWeaver AS ABAP and ABAP Platform
7.1
CVE-2026-44751
Missing Authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform
5.3
CVE-2025-42902
Memory Corruption vulnerability in SAP Netweaver AS ABAP and ABAP Platform