CVE-2026-44748

CVE Enrichment

CVSS: 9.9 CRITICAL
EPSS: 0.23%
EPSS Percentile: 14.07%
CISA KEV: Not listed

Description

SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modified signed XML documents to the verifier. This may result in acceptance of tampered identity information leading to unauthorized access to sensitive user data and potential disruption of normal system usage. This causes a high impact on confidentiality, integrity and availability of the application.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 09-Jun-2026 08:16
Last Modified: 23-Jul-2026 15:10
EPSS Date: 2026-10-30
CWE: CWE-347

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:L /
                            PR:L /
                            UI:N /
                            S:C /
                            C:H /
                            I:H /
                            A:H

References

Last enrichment sync: 31-Oct-2026 18:07
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (3)

CVE-2026-44748 (CVSS score: 9.9) – XML signature wrapping vulnerability in SAML authentication in SAP NetWeaver AS ABAP and ABAP Platform Fortinet, Ivanti and SAP Patch Critical Vulnerabilities Across Multiple Products
Organizations using these products should prioritize patching CVE-2026-44748 and CVE-2026-27671 due to their high severity and potential impact on enterprise environments. SAP Patches Critical NetWeaver and Commerce Cloud Flaws
The most severe of the resolved bugs is CVE-2026-44748 (CVSS score of 9.9), described as an XML Signature Wrapping issue in the SAML Authentication of NetWeaver AS ABAP and ABAP Platform. SAP Patches Four Critical Vulnerabilities in NetWeaver, Commerce and Data Hub

CVE (8)

People (1)

Vendors (3)

Products (13)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.