What is the CVSS score of CVE-2026-44748?

CVE-2026-44748 has a CVSS 3.1 base score of 9.9 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of SAP NetWeaver are affected by CVE-2026-44748?

SAP NetWeaver ABAP and ABAP Platform contain a critical vulnerability allowing low-privileged users to forge identities and bypass access controls; no public exploit identified at time of analysis.

How to fix or mitigate CVE-2026-44748?

Within 24 hours: Inventory all SAP NetWeaver ABAP/ABAP Platform installations; assess current low-privileged user access controls; notify security and SAP teams of critical vulnerability status. Within 7 days: Restrict low-privileged user permissions to essential functions only; implement enhanced audit logging for all XML message processing; segment affected systems from networks containing sensitive data. Within 30 days: Establish continuous monitoring of SAP security advisories for patch availability; document incident response procedures specific to identity forging; evaluate architectural changes to reduce reliance on vulnerable systems.

SAP NetWeaver CVE-2026-44748

EUVD-2026-35283 CRITICAL

Improper Verification of Cryptographic Signature (CWE-347)

2026-06-09 cna@sap.com

GHSA-c2v4-jg9m-jgrr

SAP Authentication Bypass Jwt Attack

9.9

CVSS 3.1 · Vendor: sap

Severity by source

Vendor (sap) PRIMARY

9.9 CRITICAL

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Primary rating from Vendor (sap) · only source for this CVE.

CVSS VectorVendor: sap

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 01:31 vuln.today

CVE Published

Jun 09, 2026 - 01:16 nvd

CRITICAL 9.9

DescriptionCVE.org

SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modified signed XML documents to the verifier. This may result in acceptance of tampered identity information leading to unauthorized access to sensitive user data and potential disruption of normal system usage. This causes a high impact on confidentiality, integrity and availability of the application.

Articles & Coverage 2

News 3 Critical SAP Vulnerabilities Disclosed - No Public Exploits Yet Jun 10, 2026 News Critical XML Signature Forgery in SAP NetWeaver AS ABAP - CVE-2026-44748 Jun 09, 2026

AnalysisAI

Signed XML message tampering in SAP NetWeaver Application Server ABAP and ABAP Platform allows authenticated low-privileged attackers to forge identity information by capturing a valid signed message and submitting modified signed XML documents that the verifier accepts. The scope-changing flaw (CVSS 9.9) enables unauthorized access to sensitive user data and disruption of normal operations across trust boundaries. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Technical ContextAI

SAP NetWeaver Application Server ABAP is the foundational application runtime that hosts SAP business suite components (ECC, S/4HANA, Solution Manager, etc.) and processes signed XML messages as part of SAML/WS-Security/SSO and inter-system trust flows. The root cause is CWE-347 (Improper Verification of Cryptographic Signature): the verifier appears to validate the signature against the original signed payload while accepting modifications elsewhere in the XML document - a class of flaw historically seen as XML Signature Wrapping (XSW) attacks where attackers wrap or relocate signed elements so the signature reference still resolves to the original content while the verifier consumes attacker-controlled content. The 'JWT Attack' tag suggests the same signature-verification weakness may also apply to token-based identity assertions handled by the ABAP stack.

RemediationAI

Apply the patch referenced by SAP Security Note 3746332 (https://me.sap.com/notes/3746332) according to your installed NetWeaver AS ABAP / ABAP Platform release and Support Package stack - exact fixed SP/kernel levels are listed inside the customer-authenticated note and were not provided in the public record. Customers should also review the SAP Security Patch Day bulletin at https://url.sap/sapsecuritypatchday for any companion notes that must be applied together. Until patching is possible, compensating controls include tightening account provisioning to remove unused low-privileged ABAP accounts, restricting network reachability of the ABAP stack to trusted segments via SAP Web Dispatcher or perimeter firewalls, auditing SAML/SSO and trust-relationship configurations for unexpected identity providers, and enabling Security Audit Log (SM19/RSAU_CONFIG) with alerting on identity-assertion anomalies - noting that none of these controls block the flaw itself, only reduce exposure and improve detection.