CVE-2026-44748CWE-347

XML Signature Wrapping in SAML Authentication in SAP NetWeaver AS ABAP and ABAP Platform

Critical · published June 9, 2026

CVSS v3.1
9.9
EPSS
0%
Percentile
23.8
In the wild
Unconfirmed
What it is

SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modified signed XML documents to the verifier. This may result in acceptance of tampered identity information leading to unauthorized access to sensitive user data and potential disruption of normal system usage. This causes a high impact on confidentiality, integrity and availability of the application.

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00320 · 23.8th percentile
Weakness
CWE-347 · Improper Verification of Cryptographic Signature
Published
2026-06-09T00:20Z
EPSS history
Timeline
  • 09 JUN 00:20Z
    XML Signature Wrapping in SAML Authentication in SAP NetWeaver AS ABAP and ABAP Platform
    cvelistv5