CVE-2026-44748

Vulnerability

SAP NetWeaver Application Server ABAP and ABAP Platform are vulnerable to a flaw that allows an authenticated attacker with normal privileges to obtain a valid signed message and subsequently send modified signed XML documents to the verifier. This vulnerability affects versions of SAP NetWeaver Application Server ABAP and ABAP Platform that have not yet received the relevant security patch [1].

Exploitation

An attacker must first possess normal user privileges within the affected SAP system. They need to obtain a valid signed message and then craft a modified signed XML document. This tampered document is then sent to the verifier component of the system, exploiting the trust placed in signed messages.

Impact

Successful exploitation allows an attacker to have modified identity information accepted by the system. This can lead to unauthorized access to sensitive user data and can cause disruption to normal system operations, impacting the confidentiality, integrity, and availability of the application.

Mitigation

SAP releases security corrections on a regular SAP Security Patch Day, typically the second Tuesday of every month [1]. Customers are advised to implement these corrections, provided as SAP Security Notes, with high priority. Specific details on the fixed version and release date for this particular vulnerability are not yet disclosed in the available references, but it is recommended to check SAP for Me for the latest SAP Security Notes.