Affiliate Disclosure: This site contains affiliate links. We earn a commission when you purchase through our links at no additional cost to you.

CVE-2026-44748 is a CVSS 9.9 XML signature bypass in SAP NetWeaver Application Server ABAP and ABAP Platform. An attacker with standard user credentials can obtain a legitimately signed XML message, tamper with its content, and submit the modified document to SAP’s signature verifier — which accepts it as valid.

The fix is SAP Note 3746332, released as part of SAP’s June 2026 Security Patch Day.

TL;DR

FieldDetail
CVECVE-2026-44748
CVSS9.9 (CRITICAL)
Published2026-06-09
AffectedSAP NetWeaver AS ABAP and ABAP Platform (multiple versions)
Auth requiredYes — standard user privileges only
Attack vectorNetwork
ImpactForge XML signatures accepted by the verifier; bypass document integrity checks
FixSAP Note 3746332 (June 2026 Security Patch Day)

What SAP’s XML signing actually does

SAP NetWeaver ABAP uses XML digital signatures for workflow approvals, inter-system message exchanges, purchase order processing, and document integrity verification. When a document is signed, the signature covers a specific set of XML elements. Before acting on it, the receiving system verifies those elements haven’t changed. If they have, verification fails and the document is rejected.

That verification has a flaw.

The attack class: XML Signature Wrapping

The W3C XML Digital Signature specification has a known attack category called XML Signature Wrapping (XSW). You keep the signed portion of the document intact and inject a modified version of the same content elsewhere in the XML tree. If the verifier resolves element references using the wrong namespace or context, it validates the untouched signed nodes, while the application reads data from the injected attacker-controlled ones.

CVE-2026-44748 is an XSW-class vulnerability in SAP NetWeaver ABAP. OWASP documents eight distinct XSW variants for SOAP and SAML XML; the relevant patterns for SAP involve envelope injection around <ds:SignedInfo> elements and sibling injection adjacent to referenced nodes.

The attack steps are:

  1. Obtain a legitimately signed XML message. This can be a document you triggered yourself: submitting a purchase request, initiating a workflow step, generating an workflow approval, and observing the resulting signed XML at the transport layer or from SAP’s message log.
  2. Keep the <ds:SignedInfo> and <ds:SignatureValue> blocks unchanged.
  3. Wrap the signed nodes in a parent container element. Place your modified version of the signed content in the location the application actually processes (the document body or the processing namespace, depending on the XSW variant).
  4. Submit the modified document.

If the verification code resolves references back to the original signed nodes, it returns a valid result. But if the application processing logic reads from the injected sibling or outer wrapper (which it may, depending on how SAP’s XML handler walks the tree), the attacker’s data goes through as trusted.

Why normal user privileges are enough

The CVSS base score is 9.9 rather than 10.0 because authentication is required. But “standard user” in a SAP installation means ordinary login credentials, not admin or basis-level access. Any user who can initiate a workflow that produces a signed XML document can get the raw material for this attack.

That’s relevant for bug bounty programs. If you have a legitimately provisioned SAP user account on an in-scope system, you have the access level this vulnerability requires.

What an attacker can do with it

The practical impact depends on where the verified XML feeds into SAP’s processing logic. In enterprise SAP deployments, signed XML flows through:

  • Workflow approval chains: purchase orders, expense reports, leave requests. A forged approval signature could advance a workflow step without the required approver acting.
  • Financial document exchanges: inter-company transactions and SAP integration middleware (PI/PO, BTP Integration Suite) use signed XML for integrity. Forged signatures could allow modified amounts or account details to pass integrity checks.
  • SAP-to-SAP RFC/SOAP calls: signed XML is used to authenticate messages between SAP systems. Bypassing signature verification on inbound messages could allow unauthorized actions in the receiving system.

The severity of exploitation scales with what the affected SAP system does. A development or sandbox system is lower stakes. A production ERP handling financial transactions is a different story.

Bug bounty programs in scope

SecurityClaw’s June 15 CVE report flagged CVE-2026-44748 against YesWeHack programs including Swiss Post - E-Voting (€230,000 max) and Doctolib (€50,000 max). Both run SAP or enterprise middleware in their backend operations.

SAP deployments appear frequently in larger enterprise bug bounty programs on Intigriti and YesWeHack, particularly in:

  • Financial services (banks, insurance companies)
  • Healthcare and pharmaceutical companies
  • Public sector and government programs
  • Large retail and manufacturing companies

Look for programs where the scope includes “enterprise applications,” “internal tools,” or SAP-named subdomains. Check the Rules of Engagement carefully — many programs restrict automated scanning on enterprise backends, and manual exploitation paths require explicit approval before testing.

How to test

If you have a legitimate user account on a SAP NetWeaver ABAP system that is in scope:

1. Check if the system is patched

The most defensible way to report this in a bug bounty context is demonstrating unpatched status. SAP patch levels are visible to any authenticated user via transaction SM51 (Application Server Management) or through the “System Information” screen. Check that SAP Note 3746332 is listed as applied. If it is not, the system is potentially vulnerable.

Transaction: SNOTE (SAP Note Browser)
Search note: 3746332
Status: "Implemented" = patched, anything else = investigate

2. Identify signed XML flows

Look for SAP workflow scenarios that involve XML signature validation. Relevant areas:

  • Transaction STRUSTSSO2 — certificate and trust manager; shows what signing is configured
  • SAP PI/PO integration channels — check for WS-Security or XML signature policies
  • Custom ABAP code using CL_IXML_* or SAP’s crypto classes for signature validation

3. Test XSW patterns on non-production systems

If you have a development or sandbox SAP instance available (or the program explicitly permits testing on isolated environments), the standard XSW test variants from OWASP’s XML Security Cheatsheet apply. Capture a signed SOAP or XML message, apply envelope injection (XSW Type 1 or 2), and observe whether the verifier returns success.

Do not test exploit chains on production systems without explicit written program approval for authenticated CVSS 9.9-class testing. Version evidence alone is typically sufficient to file a report and have it triaged.

Mitigation

Apply SAP Note 3746332 via transaction SNOTE in SAP’s ABAP system. SAP Note applications require a system maintenance window and testing in a non-production environment first — the SAP standard recommendation applies.

For environments that cannot patch immediately, review which SAP workflows and integration scenarios use XML signature validation and assess whether compensating controls (network segmentation, additional authorization checks) can reduce exposure.

The full list of advisories from SAP’s June 2026 Security Patch Day is at https://url.sap/sapsecuritypatchday — SAP typically releases 10–20 notes per patch day, and CVE-2026-44748 may have companion notes for adjacent issues in the same component.