CVE-2026-44748: XML Signature Wrapping in SAML Authentication in SAP NetWeaver AS ABAP and ABAP Platform

Synopsis

XML Signature Wrapping is a vulnerability in the SAML authentication handling of SAP NetWeaver Application Server ABAP and ABAP Platform. An attacker can reach this vulnerability over the network using any low-privilege account, with no victim interaction required, by capturing a valid signed SAML message and replaying a tampered version that bypasses the XML signature verifier. Successful exploitation allows the attacker to impersonate arbitrary users, read sensitive user data, modify application state, and disrupt normal system availability. HarborGuard tracks this advisory and will make a patched-image rebuild available the moment SAP publishes a fix.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the SAP NetWeaver AS ABAP service over the network; the vulnerability is exposed on any network-accessible SAML endpoint.

• AuthenticationRequired

  Any low-privilege account is sufficient; the attacker needs only a normal user session to obtain a valid signed SAML message for manipulation.

• Victim interactionNot required

  No victim action is needed; the attacker submits the tampered XML document directly to the verifier without involving another user.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental prerequisites beyond network access and a valid session.

Blast Radius

• The attacker impersonates arbitrary users by injecting tampered identity assertions, gaining access to accounts and resources beyond their own privileges.
• Sensitive user data stored or accessible through the SAP application, including personal records and business data, is exposed to direct read access.
• The attacker can modify persisted application data and business records by acting under the identity of impersonated users.
• The availability of the affected SAP NetWeaver instance can be disrupted, interrupting business-critical processes that depend on the ABAP platform.