Brief Summary: CVE-2026-120017, a SAML2 Authentication Bypass in SAP NetWeaver AS ABAP and ABAP Platform

Introduction

SAP has disclosed a flaw in the SAML2 Service Provider of SAP NetWeaver AS ABAP and ABAP Platform that, under certain configurations, can let an unauthenticated attacker impersonate any user, including privileged accounts. SAP rates it CVSS 3.1 10.0 and warns that the impact could extend beyond the affected system to connected components. That reach is a concern for ABAP landscapes, which sit at the center of finance, procurement, HR, and supply chain processes.

In this post we summarize what the public record says about CVE-2026-120017, what it leaves out, and how that affects scoping decisions.

Technical information

Root cause

The official CVE title is "Missing Authentication in SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)". The assigned weakness is CWE-347, Improper Verification of Cryptographic Signature, which MITRE defines as failing to verify, or incorrectly verifying, a cryptographic signature associated with data.

The SAML2 Service Provider is the component that consumes incoming authentication assertions and turns them into an authenticated identity on the ABAP system. SAP states that under certain configurations it does not perform sufficient verification of those assertions. An assertion the attacker crafted can therefore be accepted as proof of another user's identity.

The public record does not disclose:

• the structure of the crafted assertion
• the request endpoint involved
• the exact configuration prerequisite
• the specific signature validation behavior that is bypassed

Because of this, the sources do not establish any particular technique, such as XML signature wrapping or assertion replay. We are deliberately not speculating about one here.

Attack flow

Based on SAP's description, exploitation proceeds as follows:

1. The attacker starts with no authentication on the target system.
2. The attacker submits specially crafted data to the affected SAML2 authentication functionality.
3. Because incoming assertions are not sufficiently verified in the vulnerable configuration, authentication is bypassed.
4. The attacker is treated as an arbitrary user of their choosing, including privileged accounts.
5. From that position, SAP states that successful exploitation could cause full system compromise, with potential impact on connected components and systems.

The description does not document an observed propagation chain into connected systems, nor a separate remote code execution primitive. The broader impact follows from acting as a privileged identity. No additional bug has been disclosed behind it.

Reading the CVSS vector

SAP supplies the following vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

• AV:N: network attack vector. Per the FIRST specification this can include intranet access. It does not by itself mean the system is reachable from the Internet.
• AC:L: low attack complexity against a vulnerable configuration.
• PR:N / UI:N: no prior privileges and no user interaction required.
• S:C: changed scope, meaning impact can cross the vulnerable component's security boundary, consistent with SAP's warning about connected systems.
• C:H / I:H / A:H: high confidentiality, integrity, and availability impact.

The configuration prerequisite in the description and the low complexity in the vector answer different questions. The prerequisite limits which installations are affected, while the complexity rating describes how hard exploitation is once a vulnerable configuration exists. Separately, the 10.0 score is SAP's CNA assessment. NVD notes that its own assessment has not yet been provided.

Exploitation status

StackFlag describes the vulnerability as not known to be exploited. The reviewed CVE material reports no observed attacks, victims, campaigns, or named threat actors, and we found no public proof of concept or CVE-specific indicators of compromise. CISA KEV inclusion was not established from the accessible catalog material. Given that the CVE and NVD entries were published on November 10, 2026, this is an early, limited evidence picture rather than proof of absence. As FIRST's CVSS specification makes clear, a maximum Base score is not evidence of a working public exploit.

Affected systems and versions

The component is the SAML2 Service Provider in SAP NetWeaver AS ABAP and ABAP Platform. The complete CVE record lists the following SAP_BASIS versions as affected:

• 702
• 731
• 740
• 750, 751, 752, 753, 754, 755, 756, 757, 758
• 816
• 920, 921, 922

These are individually listed versions, not a continuous range. Use this full list rather than the shortened product display on NVD.

Vulnerable configuration: SAP states the flaw applies "under certain configurations" but does not publicly identify them. Running a listed SAP_BASIS version therefore does not, on its own, confirm that a deployment is exploitable.

Remediation pointer: Both the CVE record and NVD reference SAP Security Note 3849308. Its contents require an SAP for Me sign-in, so the correction instructions, prerequisite notes, and fixed support package are not visible publicly. SAP's general guidance is to access SAP Security Notes in SAP for Me, select All Security Notes, and implement applicable corrections with priority. NetWeaver security fixes are also delivered through support packages. StackFlag additionally suggests configuring SAML2 to require proper verification of authentication messages, but provides no settings or verified procedure, so we would not treat that as a confirmed SAP workaround.

Vendor security history

SAP SE is both the vendor and the CNA for this CVE. It runs Security Patch Day on the second Tuesday of each month and publishes security corrections as SAP Security Notes.

The most relevant precedent is CVE-2025-31324, affecting the SAP NetWeaver Visual Composer Metadata Uploader in Visual Composer Framework 7.50. Singapore's Cyber Security Agency reported active exploitation of that flaw, which also carried a CVSS 3.1 score of 10 out of 10 and could allow unauthenticated upload of malicious executable files, potentially leading to remote code execution. SAP responded with an out-of-band security update.

The comparison is useful mainly as a contrast:

• Component: Visual Composer Metadata Uploader then, AS ABAP SAML2 Service Provider now.
• Mechanism: unauthenticated file upload then, insufficient assertion verification now.
• Exploitation evidence: active exploitation reported by a government agency then, not known to be exploited now.

Equal severity scores do not imply equal operational evidence, and the exploitation status or mitigations of the earlier case should not be carried over to CVE-2026-120017.

References

• NVD: CVE-2026-120017
• CVE Record: CVE-2026-120017
• CVE Services API record for CVE-2026-120017
• SAP Security Note 3849308 (SAP for Me sign-in required)
• SAP Security Notes and News / Security Patch Day
• SAP SE Company Information
• MITRE CWE-347: Improper Verification of Cryptographic Signature
• FIRST CVSS v3.1 Specification Document
• StackFlag: CVE-2026-120017 SAP NetWeaver ABAP SAML2 allows attackers to impersonate users
• Cyber Security Agency of Singapore: Multiple Vulnerabilities in SAP Products
• Cyber Security Agency of Singapore: Active Exploitation of SAP NetWeaver Visual Composer Metadata Uploader
• CISA Known Exploited Vulnerabilities Catalog