CVE-2026-44748: XML Signature Wrapping in SAP NetWeaver AS ABAP SAML Authentication (CVSS 9.9)

CVE-2026-44748 (TL-2026-0762), also tracked as SAP June 2026 HotNews SAML XSW, is a critical-severity software vulnerability scored CVSS 9.9, first published 2026-06-10. It has no confirmed attribution, affects SAP SAP NetWeaver Application Server ABAP, references 1 CVE (CVE-2026-44748), maps to 20 MITRE ATT&CK techniques (T1021, T1068, T1069), and is covered by 9 detection rules and 20 indicators of compromise.

Key facts for TL-2026-0762

Threat ID
TL-2026-0762
Also known as
SAP June 2026 HotNews SAML XSW, SAP Note 3746332
Severity
CRITICAL
CVSS
9.9 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H)
Status
ACTIVE
Category
VULNERABILITY
First published
2026-06-10
Last reviewed
2026-06-10
Attribution confidence
NONE
Motivation
UNKNOWN
Target sectors
government, financial, healthcare, manufacturing, energy, retail, technology, critical-infrastructure
Target regions
Global, North America, Europe, Asia-Pacific
Detection rules
9
Indicators of compromise
20

Malware and tooling in CVE-2026-44748

Malware and tooling: SAML Raider (Burp Suite extension) / WS-Attacker

CVE-2026-44748 is a CVSS 9.9 XML Signature Wrapping (XSW) vulnerability in the SAML authentication of SAP NetWeaver AS ABAP and ABAP Platform, fixed in SAP Security Note 3746332 on the June 9, 2026 Patch Day. A low-privileged authenticated attacker who obtains a valid signed message can submit modified signed XML documents that still pass signature validation, causing the system to accept tampered identity data — leading to authentication bypass, unauthorized access, identity impersonation, and privilege escalation.

How CVE-2026-44748 works

On its June 9, 2026 Security Patch Day, SAP released SAP Security Note 3746332 to remediate CVE-2026-44748, the most critical issue of the month (CVSS 9.9, HotNews). The flaw is an XML Signature Wrapping (XSW) vulnerability in the SAML authentication handling of SAP NetWeaver Application Server ABAP and the ABAP Platform (component area BC-SEC-LGN-SML). The patch footprint is exceptionally broad, spanning SAP_BASIS versions 702 through 919.

XML Signature Wrapping is a class of attack against XML Digital Signatures (XML-DSig) as used in SAML assertions. It exploits the gap between the component that performs cryptographic signature verification and the component that subsequently parses and consumes the XML for business logic. The signature references a specific element (typically by Id/URI), but the verifier and the consuming parser can be made to resolve different elements. An attacker who holds one legitimately signed SAML assertion can wrap the original signed element inside an unsigned parent or sibling node and inject an attacker-controlled assertion/identity element elsewhere in the document. The signature check still validates against the preserved original signed fragment, while the application logic processes the unsigned, attacker-supplied identity claims. The result is that tampered identity data (e.g., a different NameID, role, or authorization attribute) is accepted as authentic.

The vulnerability is mapped to CWE-347 (Improper Verification of Cryptographic Signature). The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H reflects network-exploitable, low-complexity attacks requiring only low privileges (an authenticated low-privileged user able to obtain a valid signed message), no user interaction, a changed scope (the SAML trust boundary is crossed so impact extends beyond the vulnerable component), and high impact to confidentiality, integrity, and availability.

Impact: successful exploitation lets an attacker forge or tamper with SAML assertions to impersonate other identities, gain unauthorized access to sensitive user data, escalate privileges across enterprise SAP landscapes, and disrupt normal application processing. Because SAP NetWeaver AS ABAP underpins core ERP and business processes and is frequently internet-facing or reachable via trusted networks, the authentication-assurance failure can cascade into lateral movement and broad business-system compromise.

At the time of disclosure the sources reported no public proof-of-concept and no observed in-the-wild exploitation, but the severity, the very wide SAP_BASIS version range, and the authentication-bypass impact make immediate patching imperative. Where the patch cannot be applied immediately, SAP advises disabling SAML authentication as a temporary workaround. CVE-2026-44748 was the headline item among the June 2026 SAP fixes, which included other HotNews issues such as CVE-2026-27671 (memory corruption in the ABAP RFC kernel, CVSS 9.8), CVE-2026-34263 (missing authentication in Commerce Cloud, 9.6), CVE-2026-22732 (Spring Security flaw in Commerce/Data Hub, 9.1), and CVE-2026-40128 (directory traversal in NetWeaver AS Java, 9.0).

MITRE ATT&CK techniques used in TL-2026-0762

Lateral Movement

T1021 Remote Services; T1550.001 Application Access Token

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1078.002 Domain Accounts

Discovery

T1069 Permission Groups Discovery; T1087 Account Discovery

Initial Access

T1078 Valid Accounts; T1078.004 Cloud Accounts; T1190 Exploit Public-Facing Application

Persistence

T1098 Account Manipulation

Defense Evasion

T1211 Exploitation for Stealth

Collection

T1213 Data from Information Repositories

Credential Access

T1539 Steal Web Session Cookie; T1606 Forge Web Credentials; T1606.002 SAML Tokens

lateral-movement

T1550 Use Alternate Authentication Material; T1550.004 Web Session Cookie

Impact

T1565 Data Manipulation

Resource Development

T1587.004 Exploits

Reconnaissance

T1595.002 Vulnerability Scanning

Affected products and versions in CVE-2026-44748

  • SAP — SAP NetWeaver Application Server ABAP
    Vulnerable versions: SAP_BASIS 702 through 919
    Fixed in: Patched per SAP Security Note 3746332
  • SAP — SAP ABAP Platform
    Vulnerable versions: SAP_BASIS 702 through 919
    Fixed in: Patched per SAP Security Note 3746332

Remediation for CVE-2026-44748

Patches

  • SAP Security Note 3746332 (June 2026 SAP Security Patch Day) — fixes CVE-2026-44748 in SAP NetWeaver AS ABAP and ABAP Platform.

Immediate actions

  • Apply SAP Security Note 3746332 to all affected SAP NetWeaver AS ABAP / ABAP Platform systems (SAP_BASIS 702-919) as an emergency change.
  • If patching cannot be done immediately, disable SAML authentication as a temporary workaround per SAP guidance.
  • Inventory all ABAP systems acting as SAML service providers and prioritize internet-facing and high-value (S/4HANA, central finance, identity-federated) instances.

Workarounds

  • Temporarily disable SAML-based authentication on affected AS ABAP systems until SAP Note 3746332 is applied.
  • Where feasible, fail closed on SAML assertions that contain multiple assertion/identity elements or signature references that do not match the consumed element.

Longer-term hardening

  • Enforce strict SAML assertion validation that verifies the signature covers the exact element consumed by application logic (resolve XSW by ID-uniqueness and schema hardening).
  • Adopt a regular SAP Security Patch Day cadence and integrate SAP-specific vulnerability management (e.g., Onapsis/Layer Seven) into the patch program.
  • Deploy monitoring of SAP Security Audit Log (SM20/RSAU) and SAML authentication flows to detect anomalous assertion content and impossible-travel / role-change events.
  • Segment and restrict network access to AS ABAP message server, ICM, and SAML endpoints; require MFA at the identity provider.

CVEs associated with CVE-2026-44748

CVE-2026-44748

Weaknesses (CWE) in CVE-2026-44748

CWE-347

Timeline of CVE-2026-44748

  • Onapsis Research Labs, RedRays, and Layer Seven Security publish technical breakdowns identifying the issue as an XML Signature Wrapping (XSW) class flaw (CWE-347) in SAML assertion processing within component BC-SEC-LGN-SML.
  • CVE-2026-44748 ships as part of SAP's June 2026 release of 15 security notes, alongside other HotNews items: CVE-2026-27671 (ABAP RFC kernel memory corruption, 9.8), CVE-2026-34263 (missing authentication in Commerce Cloud, 9.6), CVE-2026-22732 (Spring Security flaw in Commerce/Data Hub, 9.1), and CVE-2026-40128 (NetWeaver AS Java directory traversal, 9.0).
  • SAP and analysts note disabling SAML authentication as a temporary workaround until SAP Note 3746332 can be applied.
  • Security vendors (SOCRadar, SecurityOnline, Onapsis, RedRays, Layer Seven) publish analyses describing the SAML signature-wrapping authentication bypass and the wide SAP_BASIS 702-919 footprint.
  • CVE-2026-44748 published in NVD: XML Signature Wrapping in SAP NetWeaver AS ABAP / ABAP Platform SAML authentication, CWE-347, CVSS 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).
  • SAP releases its June 2026 Security Patch Day, publishing SAP Security Note 3746332 to fix CVE-2026-44748, the month's most critical issue (HotNews, CVSS 9.9).
  • Threat-intel assessment notes the exceptionally wide SAP_BASIS 702-919 footprint and the scope-changed (S:C) CVSS, indicating exploitation could cross the SAML trust boundary and impact downstream federated SAP systems beyond the vulnerable component.
  • Belgium's Centre for Cybersecurity (CCB) issues a Warning-level advisory urging organizations to apply the SAP June 2026 patches affecting multiple SAP products, citing the critical authentication-bypass risk.
  • No public proof-of-concept exploit and no in-the-wild exploitation reported; threat tracked as ACTIVE/CRITICAL pending PoC release given the authentication-bypass impact.
  • Broad press coverage (BleepingComputer, SecurityWeek, Cyber Security News, CCB Belgium) urges immediate patching of the critical SAP NetWeaver and Commerce Cloud vulnerabilities.

Sources cited for CVE-2026-44748

Threats related to CVE-2026-44748

Detection coverage for TL-2026-0762

As of 2026-06-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0762 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats