SAP NetWeaver ABAP CVE-2026-44748: Brief Summary of a Critical XML Signature Wrapping Vulnerability

Introduction

For the second time in four months, SAP has patched a critical XML Signature Wrapping vulnerability in NetWeaver Application Server ABAP, this time with a CVSS score of 9.9. CVE-2026-44748 lets an authenticated attacker with ordinary privileges tamper with signed XML documents so that the system's signature verifier still accepts them as legitimate. That opens the door to identity spoofing, unauthorized data access, and system disruption in what could be tens of thousands of enterprise environments.

SAP ERP holds approximately 10.93% of the global ERP market, with 28,676 customer organizations, so a critical flaw in the NetWeaver ABAP stack has an outsized blast radius. This vulnerability shares its root cause (CWE-347: Improper Verification of Cryptographic Signature) and a nearly identical description with CVE-2026-23687, which was patched just four months earlier, in February 2026. That makes it fair to ask whether the signed XML processing architecture in SAP NetWeaver ABAP needs more than incremental fixes.

Technical Information

Root Cause: Improper Verification of Cryptographic Signature (CWE-347)

CVE-2026-44748 falls under CWE-347, which MITRE defines as occurring when "the product does not verify, or incorrectly verifies, the cryptographic signature for data." CWE-347 is a child of CWE-345 (Insufficient Verification of Data Authenticity) and maps to OWASP Top 10 category A04:2025 (Cryptographic Failures).

The flaw is a structural disconnect in the SAP ABAP XML signature verification logic. When the system receives a signed XML document, it validates the cryptographic signature against an element identified by an ID-based URI reference. The application logic that then processes the document does not ensure that the validated element is the same element it consumes. This gap between "what was verified" and "what gets used" is the textbook precondition for an XML Signature Wrapping attack.

It works like a wax seal on a letter. The system checks that the seal is real, but not whether the letter underneath it has been rewritten.

Attack Flow

Exploiting CVE-2026-44748 follows the well-understood XML Signature Wrapping pattern:

1. An authenticated attacker with normal (low) privileges captures or obtains a legitimately signed XML document from the SAP system. This could be a SAML assertion, a signed identity document, or any other XML structure that the system processes with signature verification.
2. The attacker moves the original signed element to a different location in the XML document tree, then inserts a new, tampered element with modified identity information in the original element's position. The cryptographic signature remains mathematically valid because it still references the original (now relocated) element through its ID attribute.
3. The attacker sends the restructured XML document to the SAP ABAP signature verifier. The verifier locates the signed element by its ID reference, validates the signature, and returns a positive result. The application logic then processes the tampered element, which now sits where the application expects to find it, and accepts the forged identity information as authentic.

Attack Parameters

Needing only authenticated access with normal privileges is a relatively low bar. Any user with a valid SAP account, including service accounts, contractors, and accounts obtained through credential theft, could exploit this vulnerability. The High rating on all three CIA dimensions reflects that a single successful exploit can exfiltrate sensitive data, modify identity information to escalate privileges, and disrupt system availability at the same time.

Related Attack Patterns

CWE-347 is associated with CAPEC-475 (Signature Spoofing by Improper Validation), which targets gaps in cryptographic verification logic. The XML Signature Wrapping technique here is a specific instance of CAPEC-475. The verifier accepts tampered data because it checks the signature on a different data object from the one the application consumes.

Connection to CVE-2026-23687

CVE-2026-23687, a nearly identical vulnerability, was addressed in the February 2026 SAP Security Patch Day under SAP Note 3697567. It carried the same description: "SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modified signed XML documents to the verifier." Tenable Nessus plugin 298966 was written specifically to detect this class of XML Signature Wrapping vulnerability in SAP NetWeaver AS ABAP. The same pattern turning up again in CVE-2026-44748 suggests one of three things: the initial patch may have been incomplete, additional attack variants were discovered, or the underlying architecture has several places where this class of flaw appears.

Identity Infrastructure Implications

XML Signature Wrapping attacks target identity and authentication infrastructure, including SAML assertions and signed identity documents. A successful exploit reaches past a single transaction to the trust model of the whole affected SAP system. If an attacker can forge identity information that the system accepts as cryptographically verified, they can impersonate any user, escalate privileges, and move laterally across the SAP landscape.

Patch Information

SAP has released Security Note 3746332 in the June 9, 2026 SAP Security Patch Day to remediate CVE-2026-44748. Given the CVSS 9.9 score, SAP classifies it as a highest-priority note. Administrators should treat it as an emergency deployment, outside the routine patch cycle.

The fix corrects the signature verification logic in the ABAP platform so that it rejects modified XML documents during verification. The patch covers the following SAP_BASIS versions:

• SAP_BASIS 702, 731, 740
• SAP_BASIS 750 through 758
• SAP_BASIS 816, 918, 919

Versions not in this list have a default status of unaffected, so the flaw is limited to these releases.

To apply the patch, administrators must download and implement SAP Security Note 3746332 from the SAP for Me portal. The note itself lists the detailed correction instructions, the affected ABAP objects, and support package prerequisites (SAP authentication required).

Organizations that have not yet applied SAP Note 3697567 for the related CVE-2026-23687 (February 2026) should prioritize both notes, because the two vulnerabilities share the same root cause and attack vector.

Compensating controls while patching is pending:

• Restrict the number of users with SAP NetWeaver ABAP accounts, particularly those with normal privileges in environments that process signed XML documents
• Deploy SAP-specific security monitoring (such as Onapsis or SecurityBridge) to detect unusual signed XML document submissions or changes to identity information
• Segment the network to limit the paths to SAP NetWeaver ABAP systems

Affected Systems and Versions

Based on the patch coverage in SAP Security Note 3746332, these SAP_BASIS versions are confirmed affected:

• SAP_BASIS 702
• SAP_BASIS 731
• SAP_BASIS 740
• SAP_BASIS 750, 751, 752, 753, 754, 755, 756, 757, 758
• SAP_BASIS 816
• SAP_BASIS 918
• SAP_BASIS 919

The affected product is SAP NetWeaver Application Server ABAP and ABAP Platform. Versions not listed above have a default status of unaffected per the SAP Security Note. Organizations should check SAP Note 3746332 directly for version-specific applicability and any support package prerequisites.

Vendor Security History

SAP NetWeaver has a documented history of critical-severity vulnerabilities that have drawn government alerts and active exploitation:

SAP Security Patch Days in 2026 have carried a steady volume of critical- and high-severity vulnerabilities, with at least one CVSS 9.0+ vulnerability each month through April. Two CWE-347 XML Signature Wrapping vulnerabilities in the same product within four months suggest that the signed XML handling architecture in SAP NetWeaver ABAP may need a more fundamental redesign than point patches can provide.

Confirmed exploitation of CVE-2025-31324, in which threat actors uploaded JSP web shells to SAP NetWeaver servers, shows that SAP NetWeaver weaknesses are active targets. Palo Alto Unit 42, Onapsis, Horizon3.ai, and TXOne Networks all documented active exploitation campaigns against SAP NetWeaver in 2025, and in some cases exploitation was observed before public disclosure.

As of its June 9, 2026 publication date, no public source confirms active exploitation of CVE-2026-44748 specifically. Three factors still make near-term exploitation more likely: a low exploitation barrier, well-documented XML Signature Wrapping techniques with published research and tooling, and the interest threat actors have already shown in SAP NetWeaver vulnerabilities.

References

• CVE-2026-44748 NVD Entry
• CVE-2026-44748 CVE Record
• SAP Security Note 3746332
• SAP Security Patch Day
• SAP Security Patch Day Portal
• CVE-2026-23687 NVD Entry
• CWE-347: Improper Verification of Cryptographic Signature (MITRE)
• Tenable Nessus Plugin 298966: SAP NetWeaver AS ABAP XML Signature Wrapping
• Onapsis: SAP Security Notes February 2026 Patch Day
• Pathlock: SAP Patch Day February 2026
• Palo Alto Unit 42: Threat Brief CVE-2025-31324
• Onapsis: CVE-2025-31324 SAP Zero-Day Vulnerability
• Horizon3.ai: CVE-2025-31324 SAP NetWeaver Visual Composer
• TXOne Networks: Active Exploitation of SAP CVEs
• Cybersecurity Dive: Critical Vulnerability in SAP NetWeaver
• 6sense: ERP Market Share Data
• ASUG: What's New From SAP Security Patch June 2026
• CSA Singapore: Critical Vulnerability in SAP S/4HANA
• Red Canary: CVE-2025-31324 in SAP NetWeaver
• SecurityWeek: SAP Patches Critical ABAP Vulnerability