CVE-2026-44748

Summary

SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modified signed XML documents to the verifier. This may result in acceptance of tampered identity information leading to unauthorized access to sensitive user data and potential disruption of normal system usage. This causes a high impact on confidentiality, integrity and availability of the application.

Affected Software

VendorProductVersion RangeStatus
SAP_SESAP NetWeaver AS ABAP and ABAP PlatformSAP_BASIS 702affected
SAP_SESAP NetWeaver AS ABAP and ABAP PlatformSAP_BASIS 731affected
SAP_SESAP NetWeaver AS ABAP and ABAP PlatformSAP_BASIS 740affected
SAP_SESAP NetWeaver AS ABAP and ABAP PlatformSAP_BASIS 750affected
SAP_SESAP NetWeaver AS ABAP and ABAP PlatformSAP_BASIS 751affected
SAP_SESAP NetWeaver AS ABAP and ABAP PlatformSAP_BASIS 752affected
SAP_SESAP NetWeaver AS ABAP and ABAP PlatformSAP_BASIS 753affected
SAP_SESAP NetWeaver AS ABAP and ABAP PlatformSAP_BASIS 754affected
SAP_SESAP NetWeaver AS ABAP and ABAP PlatformSAP_BASIS 755affected
SAP_SESAP NetWeaver AS ABAP and ABAP PlatformSAP_BASIS 756affected
SAP_SESAP NetWeaver AS ABAP and ABAP PlatformSAP_BASIS 757affected
SAP_SESAP NetWeaver AS ABAP and ABAP PlatformSAP_BASIS 758affected
SAP_SESAP NetWeaver AS ABAP and ABAP PlatformSAP_BASIS 816affected
SAP_SESAP NetWeaver AS ABAP and ABAP PlatformSAP_BASIS 918affected
SAP_SESAP NetWeaver AS ABAP and ABAP PlatformSAP_BASIS 919affected

Weaknesses

  • CWE-347: CWE-347: Improper Verification of Cryptographic Signature

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References