# CVE-2026-44748: XML Signature Wrapping in SAP NetWeaver AS ABAP SAML Authentication (CVSS 9.9)

> CVE-2026-44748 is a CVSS 9.9 XML Signature Wrapping (XSW) vulnerability in the SAML authentication of SAP NetWeaver AS ABAP and ABAP Platform, fixed in SAP Security Note 3746332 on the June 9, 2026 Patch Day. A low-privileged authenticated attacker who obtains a valid signed message can submit modified signed XML documents that still pass signature validation, causing the system to accept tampered identity data — leading to authentication bypass, unauthorized access, identity impersonation, and privilege escalation.

- **Published:** 2026-06-10T00:00:00Z
- **Last reviewed:** 2026-06-10T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0762
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-sap-saml-authentication-bypass-tl-2026-0762.webp?v=80d415de (Threadlinqs threat intel: CVE-2026-44748 SAP SAML Auth Bypass: Detection & IOCs (TL-2026-0762) — Critical severity, 20 IOCs, 9 detection rules.)
- **ID:** TL-2026-0762
- **Severity:** CRITICAL (CVSS 9.9)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 20
- **CVEs:** CVE-2026-44748

## Description

On its June 9, 2026 Security Patch Day, SAP released SAP Security Note 3746332 to remediate CVE-2026-44748, the most critical issue of the month (CVSS 9.9, HotNews). The flaw is an XML Signature Wrapping (XSW) vulnerability in the SAML authentication handling of SAP NetWeaver Application Server ABAP and the ABAP Platform (component area BC-SEC-LGN-SML). The patch footprint is exceptionally broad, spanning SAP_BASIS versions 702 through 919.

XML Signature Wrapping is a class of attack against XML Digital Signatures (XML-DSig) as used in SAML assertions. It exploits the gap between the component that performs cryptographic signature verification and the component that subsequently parses and consumes the XML for business logic. The signature references a specific element (typically by Id/URI), but the verifier and the consuming parser can be made to resolve different elements. An attacker who holds one legitimately signed SAML assertion can wrap the original signed element inside an unsigned parent or sibling node and inject an attacker-controlled assertion/identity element elsewhere in the document. The signature check still validates against the preserved original signed fragment, while the application logic processes the unsigned, attacker-supplied identity claims. The result is that tampered identity data (e.g., a different NameID, role, or authorization attribute) is accepted as authentic.

The vulnerability is mapped to CWE-347 (Improper Verification of Cryptographic Signature). The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H reflects network-exploitable, low-complexity attacks requiring only low privileges (an authenticated low-privileged user able to obtain a valid signed message), no user interaction, a changed scope (the SAML trust boundary is crossed so impact extends beyond the vulnerable component), and high impact to confidentiality, integrity, and availability.

Impact: successful exploitation lets an attacker forge or tamper with SAML assertions to impersonate other identities, gain unauthorized access to sensitive user data, escalate privileges across enterprise SAP landscapes, and disrupt normal application processing. Because SAP NetWeaver AS ABAP underpins core ERP and business processes and is frequently internet-facing or reachable via trusted networks, the authentication-assurance failure can cascade into lateral movement and broad business-system compromise.

At the time of disclosure the sources reported no public proof-of-concept and no observed in-the-wild exploitation, but the severity, the very wide SAP_BASIS version range, and the authentication-bypass impact make immediate patching imperative. Where the patch cannot be applied immediately, SAP advises disabling SAML authentication as a temporary workaround. CVE-2026-44748 was the headline item among the June 2026 SAP fixes, which included other HotNews issues such as CVE-2026-27671 (memory corruption in the ABAP RFC kernel, CVSS 9.8), CVE-2026-34263 (missing authentication in Commerce Cloud, 9.6), CVE-2026-22732 (Spring Security flaw in Commerce/Data Hub, 9.1), and CVE-2026-40128 (directory traversal in NetWeaver AS Java, 9.0).

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1078.004 Cloud Accounts
- T1606.002 SAML Tokens
- T1606 Forge Web Credentials
- T1539 Steal Web Session Cookie
- T1550.004 Web Session Cookie
- T1550 Use Alternate Authentication Material
- T1211 Exploitation for Stealth
- T1068 Exploitation for Privilege Escalation
- T1078.002 Domain Accounts
- T1098 Account Manipulation
- T1087 Account Discovery
- T1069 Permission Groups Discovery
- T1550.001 Application Access Token
- T1021 Remote Services
- T1213 Data from Information Repositories
- T1565 Data Manipulation
- T1595.002 Vulnerability Scanning
- T1587.004 Exploits

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SAP SAML XSW — Multiple Assertions / Signatures in SAMLResponse to ACS (Exploitation)** (`TL-2026-0762-SPL-001`)

Detects the core exploitation primitive of CVE-2026-44748: an XML Signature Wrapping (XSW) SAMLResponse POSTed to the SAP AS ABAP SAML2 Assertion Consumer Service (/sap/saml2/sp/acs) that contains more than one saml:Assertion and/or more than one ds:Signature element. A legitimate SAML flow carries a single consumed assertion; multiple assertions or signatures are the hallmark of a wrapped/forged token where the signed element and the consumed identity element differ.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1606.002, T1606
- **Data sources:** sap_icm, web_proxy, windows_iis
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=web sourcetype="sap:icm:access" uri_path="/sap/saml2/sp/acs" http_method=POST
| eval saml_decoded=urldecode(replace(form_data,"^.*SAMLResponse=",""))
| eval saml_xml=if(match(saml_decoded,"<saml"),saml_decoded,base64decode(saml_decoded))
| rex max_match=0 field=saml_xml "(?<assertion><saml:Assertion[ >])"
| rex max_match=0 field=saml_xml "(?<signature><ds:Signature[ >])"
| eval assertion_count=mvcount(assertion), signature_count=mvcount(signature)
| where assertion_count>1 OR signature_count>1
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip user uri_path assertion_count signature_count
| `comment("CVE-2026-44748: >1 Assertion or >1 Signature = XML Signature Wrapping candidate")`
```

### Microsoft KQL

```kql
let acs = "/sap/saml2/sp/acs";
W3CIISLog
| where TimeGenerated > ago(24h)
| where csUriStem has acs and csMethod == "POST"
| extend SamlXml = base64_decode_tostring(extract("SAMLResponse=([^&]+)", 1, csUriQuery))
| extend AssertionCount = countof(SamlXml, "<saml:Assertion"), SignatureCount = countof(SamlXml, "<ds:Signature")
| where AssertionCount > 1 or SignatureCount > 1
| project TimeGenerated, cIP, csUserName, csUriStem, AssertionCount, SignatureCount
```

### Sigma

```yaml
title: SAP SAML XSW - Multiple Assertions or Signatures in SAMLResponse (CVE-2026-44748)
id: 7a1c5f2e-3b94-4d61-9c2a-1f0e44748001
status: experimental
description: Detects an XML Signature Wrapping SAMLResponse with more than one Assertion or Signature POSTed to the SAP AS ABAP SAML2 ACS endpoint.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-44748
  - https://me.sap.com/notes/3746332
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/06/10
tags:
  - attack.initial_access
  - attack.t1190
  - attack.credential_access
  - attack.t1606.002
  - cve.2026.44748
logsource:
  category: webserver
  product: sap_icm
detection:
  selection_path:
    cs-uri-stem|contains: '/sap/saml2/sp/acs'
    cs-method: 'POST'
  selection_anomaly:
    - decoded_saml|re: '(<saml:Assertion[ >]).*(<saml:Assertion[ >])'
    - decoded_saml|re: '(<ds:Signature[ >]).*(<ds:Signature[ >])'
  condition: selection_path and selection_anomaly
falsepositives:
  - SAML IdP-proxy or aggregation flows that legitimately deliver multiple assertions
level: high
```

**Known false positives:**

- SAML IdP-proxy / assertion-aggregation gateways that legitimately forward multiple assertions
- Penetration testing with SAML Raider / WS-Attacker in pre-production

**Tuning notes:** Whitelist known IdP-proxy source IPs that legitimately deliver multi-assertion responses. If ICM does not log the decoded SAMLResponse body, deploy a WAF/reverse-proxy SAML-inspection rule upstream and forward its verdict. Tune assertion_count/signature_count thresholds to >1 only after baselining your federation topology.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- SAP SAML XSW — Signature Reference vs Consumed NameID Mismatch / Duplicate Element IDs (Exploitation) (locked: unlock with TL Creds)
- SAP Impossible-Travel / Anomalous NameID on SAML Logon Success (Post-Exploitation Identity Impersonation) (locked: unlock with TL Creds)
- SAP Sensitive Data Access Burst by Newly Federated Identity (C2 / Collection After Bypass) (locked: unlock with TL Creds)
- SAP SAML XSW — Oversized / Deeply Nested SAMLResponse to ACS Endpoint (Exploitation Heuristic) (locked: unlock with TL Creds)
- SAP SAML Logon From Low-Privilege Account Resolving to High-Privilege NameID (Post-Exploitation Priv-Esc) (locked: unlock with TL Creds)
- SAP SAML XSW Tooling Fingerprints — SAML Raider / WS-Attacker Against ACS (C2 / Recon-Exploit) (locked: unlock with TL Creds)
- SAP USR02 Authorization Change Immediately Following SAML Logon (Post-Exploitation Priv-Esc) (locked: unlock with TL Creds)
- SAP SAML Session Reuse for Lateral Movement Across Federated Systems (C2 / Lateral Movement) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [SAP Security Patch Day June 2026 – CVE-2026-44748 (SOCRadar)](https://socradar.io/blog/sap-security-patch-day-june-2026-cve-2026-44748/)
- [SAP Security Patch Day: Critical Security Vulnerabilities Remediated (SecurityOnline)](https://securityonline.info/sap-security-patch-day-june-2026/)
- [SAP Security Patch Day - June 2026 (SAP Support / Security Notes)](https://support.sap.com/en/my-support/knowledge-base/security-notes-news/june-2026.html)
- [SAP Security Note 3746332](https://me.sap.com/notes/3746332)
- [NVD - CVE-2026-44748](https://nvd.nist.gov/vuln/detail/CVE-2026-44748)
- [SAP Security Patch Day for June 2026 (Onapsis Research Labs)](https://onapsis.com/blog/sap-security-patch-day-june-2026/)
- [SAP Security Patch Day June 2026 (RedRays)](https://redrays.io/blog/sap-security-patch-day-june-2026/)
- [SAP Security Notes, June 2026 (Layer Seven Security)](https://www.layersevensecurity.com/sap-security-notes-june-2026/)
- [SAP fixes critical flaws in NetWeaver and Commerce Cloud (BleepingComputer)](https://www.bleepingcomputer.com/news/security/sap-fixes-critical-flaws-in-netweaver-and-commerce-cloud/)
- [SAP Patches Critical NetWeaver, Commerce Vulnerabilities (SecurityWeek)](https://www.securityweek.com/sap-patches-critical-netweaver-commerce-vulnerabilities/)
- [SAP Security Patch Day June – Critical Vulnerabilities in SAP NetWeaver Patched (Cyber Security News)](https://cybersecuritynews.com/sap-security-patch-day-june/)
- [SAP NetWeaver ABAP Signed XML Tampering Leads to Unauthorized Access (TheHackerWire)](https://www.thehackerwire.com/sap-netweaver-abap-signed-xml-tampering-leads-to-unauthorized-access/)
- [Warning: SAP Addresses Critical Vulnerabilities Affecting Multiple SAP products (CCB Belgium)](https://ccb.belgium.be/advisories/warning-sap-addresses-critical-vulnerabilities-affecting-multiple-sap-products-patch)
- [CWE-347: Improper Verification of Cryptographic Signature (MITRE)](https://cwe.mitre.org/data/definitions/347.html)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0762