Skip to navigation

Threat reportVulnerabilityTL-2026-0762

CVE-2026-44748: XML Signature Wrapping in SAP NetWeaver AS ABAP SAML Authentication (CVSS 9.9)

criticalACTIVE

CVE-2026-44748 is a CVSS 9.9 XML Signature Wrapping (XSW) vulnerability in the SAML authentication of SAP NetWeaver AS ABAP and ABAP Platform, fixed in SAP Security Note 3746332 on the June 9, 2026 Patch Day. A low-privileged authenticated attacker who obtains a valid signed message can submit modified signed XML documents that still pass signature validation, causing the system to accept tampered identity data — leading to authentication bypass, unauthorized access, identity impersonation, and privilege escalation.

Key facts for SAP SAML authentication bypass

IdentifiersTL-2026-0762, CVE-2026-44748
Also known asSAP June 2026 HotNews SAML XSW, SAP Note 3746332
SeverityCRITICAL
CVSS9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Exploitation statusNo exploitation observed (theoretical)
EPSSCVE-2026-44748: 0.2% (12.9th percentile)
Affected productsSAP SAP NetWeaver Application Server ABAP; SAP SAP ABAP Platform
Weaknesses (CWE)CWE-347
ToolsSAML Raider (Burp Suite extension) / WS-Attacker
MITRE ATT&CK techniquesT1021 Remote Services, T1068 Exploitation for Privilege Escalation, T1069 Permission Groups Discovery, T1078 Valid Accounts, T1078.002 Domain Accounts, T1078.004 Cloud Accounts, T1087 Account Discovery, T1098 Account Manipulation, T1190 Exploit Public-Facing Application, T1211 Exploitation for Stealth, T1213 Data from Information Repositories, T1539 Steal Web Session Cookie and 8 more in the attack flow
MotivationUNKNOWN
Target sectorsgovernment, financial, healthcare, manufacturing, energy, retail, technology, critical-infrastructure
Target regionsGlobal, North America, Europe, Asia-Pacific
Detection rules9 (1 shown free)
Sources14 cited sources

Detection coverage for SAP SAML authentication bypass

As of 2026-06-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0762 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SAP SAML XSW — Multiple Assertions / Signatures in SAMLResponse to ACS (Exploitation)

Detects the core exploitation primitive of CVE-2026-44748: an XML Signature Wrapping (XSW) SAMLResponse POSTed to the SAP AS ABAP SAML2 Assertion Consumer Service (/sap/saml2/sp/acs) that contains more than one saml:Assertion and/or more than one ds:Signature element. A legitimate SAML flow carries a single consumed assertion; multiple assertions or signatures are the hallmark of a wrapped/forged token where the signed element and the consumed identity element differ.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1190, T1606.002, T1606
  • Data sources: sap_icm, web_proxy, windows_iis
  • Severity: critical
  • Confidence: high

Splunk SPL

index=web sourcetype="sap:icm:access" uri_path="/sap/saml2/sp/acs" http_method=POST
| eval saml_decoded=urldecode(replace(form_data,"^.*SAMLResponse=",""))
| eval saml_xml=if(match(saml_decoded,"<saml"),saml_decoded,base64decode(saml_decoded))
| rex max_match=0 field=saml_xml "(?<assertion><saml:Assertion[ >])"
| rex max_match=0 field=saml_xml "(?<signature><ds:Signature[ >])"
| eval assertion_count=mvcount(assertion), signature_count=mvcount(signature)
| where assertion_count>1 OR signature_count>1
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip user uri_path assertion_count signature_count
| `comment("CVE-2026-44748: >1 Assertion or >1 Signature = XML Signature Wrapping candidate")`

Microsoft KQL

let acs = "/sap/saml2/sp/acs";
W3CIISLog
| where TimeGenerated > ago(24h)
| where csUriStem has acs and csMethod == "POST"
| extend SamlXml = base64_decode_tostring(extract("SAMLResponse=([^&]+)", 1, csUriQuery))
| extend AssertionCount = countof(SamlXml, "<saml:Assertion"), SignatureCount = countof(SamlXml, "<ds:Signature")
| where AssertionCount > 1 or SignatureCount > 1
| project TimeGenerated, cIP, csUserName, csUriStem, AssertionCount, SignatureCount

Sigma

title: SAP SAML XSW - Multiple Assertions or Signatures in SAMLResponse (CVE-2026-44748)
id: 7a1c5f2e-3b94-4d61-9c2a-1f0e44748001
status: experimental
description: Detects an XML Signature Wrapping SAMLResponse with more than one Assertion or Signature POSTed to the SAP AS ABAP SAML2 ACS endpoint.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-44748
  - https://me.sap.com/notes/3746332
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/10
tags:
  - attack.initial_access
  - attack.t1190
  - attack.credential_access
  - attack.t1606.002
  - cve.2026.44748
logsource:
  category: webserver
  product: sap_icm
detection:
  selection_path:
    cs-uri-stem|contains: '/sap/saml2/sp/acs'
    cs-method: 'POST'
  selection_anomaly:
    - decoded_saml|re: '(<saml:Assertion[ >]).*(<saml:Assertion[ >])'
    - decoded_saml|re: '(<ds:Signature[ >]).*(<ds:Signature[ >])'
  condition: selection_path and selection_anomaly
falsepositives:
  - SAML IdP-proxy or aggregation flows that legitimately deliver multiple assertions
level: high

Known false positives:

  • SAML IdP-proxy / assertion-aggregation gateways that legitimately forward multiple assertions
  • Penetration testing with SAML Raider / WS-Attacker in pre-production

Tuning notes: Whitelist known IdP-proxy source IPs that legitimately deliver multi-assertion responses. If ICM does not log the decoded SAMLResponse body, deploy a WAF/reverse-proxy SAML-inspection rule upstream and forward its verdict. Tune assertion_count/signature_count thresholds to >1 only after baselining your federation topology.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • SAP SAML XSW — Signature Reference vs Consumed NameID Mismatch / Duplicate Element IDs (Exploitation) · unlock with TL Creds
  • SAP Impossible-Travel / Anomalous NameID on SAML Logon Success (Post-Exploitation Identity Impersonation) · unlock with TL Creds
  • SAP Sensitive Data Access Burst by Newly Federated Identity (C2 / Collection After Bypass) · unlock with TL Creds
  • SAP SAML XSW — Oversized / Deeply Nested SAMLResponse to ACS Endpoint (Exploitation Heuristic) · unlock with TL Creds
  • SAP SAML Logon From Low-Privilege Account Resolving to High-Privilege NameID (Post-Exploitation Priv-Esc) · unlock with TL Creds
  • SAP SAML XSW Tooling Fingerprints — SAML Raider / WS-Attacker Against ACS (C2 / Recon-Exploit) · unlock with TL Creds
  • SAP USR02 Authorization Change Immediately Following SAML Logon (Post-Exploitation Priv-Esc) · unlock with TL Creds
  • SAP SAML Session Reuse for Lateral Movement Across Federated Systems (C2 / Lateral Movement) · unlock with TL Creds

Indicators of compromise for SAP SAML authentication bypass

As of 2026-06-10, Threadlinqs Intelligence tracks 20 indicators of compromise for TL-2026-0762.

20 indicators of compromise · unlock with TL Creds. Compare plans

How SAP SAML authentication bypass works

On its June 9, 2026 Security Patch Day, SAP released SAP Security Note 3746332 to remediate CVE-2026-44748, the most critical issue of the month (CVSS 9.9, HotNews). The flaw is an XML Signature Wrapping (XSW) vulnerability in the SAML authentication handling of SAP NetWeaver Application Server ABAP and the ABAP Platform (component area BC-SEC-LGN-SML). The patch footprint is exceptionally broad, spanning SAP_BASIS versions 702 through 919.

XML Signature Wrapping is a class of attack against XML Digital Signatures (XML-DSig) as used in SAML assertions. It exploits the gap between the component that performs cryptographic signature verification and the component that subsequently parses and consumes the XML for business logic. The signature references a specific element (typically by Id/URI), but the verifier and the consuming parser can be made to resolve different elements. An attacker who holds one legitimately signed SAML assertion can wrap the original signed element inside an unsigned parent or sibling node and inject an attacker-controlled assertion/identity element elsewhere in the document. The signature check still validates against the preserved original signed fragment, while the application logic processes the unsigned, attacker-supplied identity claims. The result is that tampered identity data (e.g., a different NameID, role, or authorization attribute) is accepted as authentic.

The vulnerability is mapped to CWE-347 (Improper Verification of Cryptographic Signature). The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H reflects network-exploitable, low-complexity attacks requiring only low privileges (an authenticated low-privileged user able to obtain a valid signed message), no user interaction, a changed scope (the SAML trust boundary is crossed so impact extends beyond the vulnerable component), and high impact to confidentiality, integrity, and availability.

Impact: successful exploitation lets an attacker forge or tamper with SAML assertions to impersonate other identities, gain unauthorized access to sensitive user data, escalate privileges across enterprise SAP landscapes, and disrupt normal application processing. Because SAP NetWeaver AS ABAP underpins core ERP and business processes and is frequently internet-facing or reachable via trusted networks, the authentication-assurance failure can cascade into lateral movement and broad business-system compromise.

At the time of disclosure the sources reported no public proof-of-concept and no observed in-the-wild exploitation, but the severity, the very wide SAP_BASIS version range, and the authentication-bypass impact make immediate patching imperative. Where the patch cannot be applied immediately, SAP advises disabling SAML authentication as a temporary workaround. CVE-2026-44748 was the headline item among the June 2026 SAP fixes, which included other HotNews issues such as CVE-2026-27671 (memory corruption in the ABAP RFC kernel, CVSS 9.8), CVE-2026-34263 (missing authentication in Commerce Cloud, 9.6), CVE-2026-22732 (Spring Security flaw in Commerce/Data Hub, 9.1), and CVE-2026-40128 (directory traversal in NetWeaver AS Java, 9.0).

MITRE ATT&CK techniques by tactic:

Lateral Movement

T1021 Remote Services; T1550.001 Application Access Token

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1078.002 Domain Accounts

Discovery

T1069 Permission Groups Discovery; T1087 Account Discovery

Initial Access

T1078 Valid Accounts; T1078.004 Cloud Accounts; T1190 Exploit Public-Facing Application

Persistence

T1098 Account Manipulation

Defense Evasion

T1211 Exploitation for Stealth

Collection

T1213 Data from Information Repositories

Credential Access

T1539 Steal Web Session Cookie; T1606 Forge Web Credentials; T1606.002 SAML Tokens

lateral-movement

T1550 Use Alternate Authentication Material; T1550.004 Web Session Cookie

Impact

T1565 Data Manipulation

Resource Development

T1587.004 Exploits

Reconnaissance

T1595.002 Vulnerability Scanning

Remediation for SAP SAML authentication bypass

Patches

  • SAP Security Note 3746332 (June 2026 SAP Security Patch Day) — fixes CVE-2026-44748 in SAP NetWeaver AS ABAP and ABAP Platform.

Immediate actions

  • Apply SAP Security Note 3746332 to all affected SAP NetWeaver AS ABAP / ABAP Platform systems (SAP_BASIS 702-919) as an emergency change.
  • If patching cannot be done immediately, disable SAML authentication as a temporary workaround per SAP guidance.
  • Inventory all ABAP systems acting as SAML service providers and prioritize internet-facing and high-value (S/4HANA, central finance, identity-federated) instances.

Workarounds

  • Temporarily disable SAML-based authentication on affected AS ABAP systems until SAP Note 3746332 is applied.
  • Where feasible, fail closed on SAML assertions that contain multiple assertion/identity elements or signature references that do not match the consumed element.

Longer-term hardening

  • Enforce strict SAML assertion validation that verifies the signature covers the exact element consumed by application logic (resolve XSW by ID-uniqueness and schema hardening).
  • Adopt a regular SAP Security Patch Day cadence and integrate SAP-specific vulnerability management (e.g., Onapsis/Layer Seven) into the patch program.
  • Deploy monitoring of SAP Security Audit Log (SM20/RSAU) and SAML authentication flows to detect anomalous assertion content and impossible-travel / role-change events.
  • Segment and restrict network access to AS ABAP message server, ICM, and SAML endpoints; require MFA at the identity provider.

Affected and fixed versions

  • SAP — SAP NetWeaver Application Server ABAP
    Vulnerable versions: SAP_BASIS 702 through 919
    Fixed in: Patched per SAP Security Note 3746332
  • SAP — SAP ABAP Platform
    Vulnerable versions: SAP_BASIS 702 through 919
    Fixed in: Patched per SAP Security Note 3746332

Timeline of SAP SAML authentication bypass

  • Onapsis Research Labs, RedRays, and Layer Seven Security publish technical breakdowns identifying the issue as an XML Signature Wrapping (XSW) class flaw (CWE-347) in SAML assertion processing within component BC-SEC-LGN-SML.
  • CVE-2026-44748 ships as part of SAP's June 2026 release of 15 security notes, alongside other HotNews items: CVE-2026-27671 (ABAP RFC kernel memory corruption, 9.8), CVE-2026-34263 (missing authentication in Commerce Cloud, 9.6), CVE-2026-22732 (Spring Security flaw in Commerce/Data Hub, 9.1), and CVE-2026-40128 (NetWeaver AS Java directory traversal, 9.0).
  • SAP and analysts note disabling SAML authentication as a temporary workaround until SAP Note 3746332 can be applied.
  • Security vendors (SOCRadar, SecurityOnline, Onapsis, RedRays, Layer Seven) publish analyses describing the SAML signature-wrapping authentication bypass and the wide SAP_BASIS 702-919 footprint.
  • CVE-2026-44748 published in NVD: XML Signature Wrapping in SAP NetWeaver AS ABAP / ABAP Platform SAML authentication, CWE-347, CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
  • SAP releases its June 2026 Security Patch Day, publishing SAP Security Note 3746332 to fix CVE-2026-44748, the month's most critical issue (HotNews, CVSS 9.9).
  • Threat-intel assessment notes the exceptionally wide SAP_BASIS 702-919 footprint and the scope-changed (S:C) CVSS, indicating exploitation could cross the SAML trust boundary and impact downstream federated SAP systems beyond the vulnerable component.
  • Belgium's Centre for Cybersecurity (CCB) issues a Warning-level advisory urging organizations to apply the SAP June 2026 patches affecting multiple SAP products, citing the critical authentication-bypass risk.
  • No public proof-of-concept exploit and no in-the-wild exploitation reported; threat tracked as ACTIVE/CRITICAL pending PoC release given the authentication-bypass impact.
  • Broad press coverage (BleepingComputer, SecurityWeek, Cyber Security News, CCB Belgium) urges immediate patching of the critical SAP NetWeaver and Commerce Cloud vulnerabilities.

Sources cited for SAP SAML authentication bypass

Drafted by the Threadlinqs research pipeline from 14 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats