When a "Valid Signature" Isn't Enough: Inside CVE-2026-44748, SAP's Critical SAML Authentication Bypass

CVSS 9.9 | XML Signature Wrapping | SAP NetWeaver AS ABAP & ABAP Platform | Patched June 9, 2026

Introduction: The Trust You Didn't Know You Were Misplacing

In the case of a critical SAML authentication bypass, the answer isn't as simple as a valid signature, because that's what has happened in SAP's CVE-2026-44748. This is a Security Vulnerability that was patched on June 9, 2026.This is a Security Vulnerability that was patched in June 9, 2026.

The Trust You Didn't Know You Were Misplacing A lot of cryptographic magic takes place when an employee logs on to an SAP system via Single Sign-On. An identity provider issues a digital "passport" (SAML assertion) that certifies the identity of that user. The SAP system does a signature check, finds it valid and accepts the identity within it. Then what if an attacker could retain that valid signature... but swap out the passport photo…? This is the crux of an extremely high severity (CVSS 9.9) critical vulnerability announced on SAP's June 2026 Security Patch Day, CVE-2026-44748. It impacts SAP NetWeaver Application Server ABAP and ABAP Platform, and it attacks the very essence of trust that is the basis of SSO and federated authentication. In this post I explain what the vulnerability is, why XML Signature Wrapping (XSW) attacks are quite dangerous in the real world, and — most important of all — how to detect and mitigate them.

Background: How SAML Authentication Actually Works

A detailed explanation of how SAML Authentication works. Background: How SAML Authentication Actually Works If we are to have a better understanding of what went wrong, it will help to understand what should go right. The typical SAML SSO flow is: 1. A user tries to access an SAP application. 2. SAP forwards the user to an Identity Provider (IdP) (Azure AD, Okta or an internal SAP Identity Authentication service). 3. The IdP authenticates the user and issues an XML document called a SAML Assertion, which says "this user is Jane Doe and has these roles and attributes. The IdP signs this assertion with XML Signature (XMLDSig) so that SAP can verify that it was not tampered with in any way. If the signature is valid, then SAP (the Service Provider) receives the assertion, verifies the signature and — in the case of a successful verification — extracts the identity information and grants access. The security model relies on a single assumption: if the signature is correct then the identity data contained within it is correct. XML Signature Wrapping attacks take advantage of a very subtle and very dangerous mistake in how that assumption is manifested.

The Vulnerability: What Is XML Signature Wrapping?

Vulnerability of XML Signature Wrapping. Unlike a flat document such as a PDF, XML is structured like a tree: elements can be nested, duplicated and rearranged without being invalid, but can cause a parser to get confused. XML Signature Wrapping attacks abuse this flexibility. The overall method is as follows: The attacker is able to get a validly-signed XML document (in this case a SAML assertion that is signed by a legitimate IdP for their own, less privileged account). The attacker creates a copy of the original signed element to a new position in the document, enclosing the original element in a different structure. 3. The attacker places a fake new element into the place where the application is looking for an identity element (e.g. pretending to be an administrator). 4. The signature verification routine looks for the original signed element in the document and returns “yes” if the signature is valid. However, the business logic that reads the identity data does not read from the signed element, but rather from the forged element provided by the attacker. The outcome: a signature that is cryptographically valid, attached to a document, and the data that the application actually acts upon has not been signed.

How CVE-2026-44748 Applies This

A valid signed SAML message can be sent by an authenticated attacker with normal privileges after signing, and the XML structure can be modified before the message is sent to the verifier, according to SAP's advisory (Security Note #3746332). The verifier doesn't correctly validate the cryptographic signature against the entire XML document, so it could accept identity information that's been corrupted.

This can result in unauthorised access to sensitive information of users, privilege escalation, disruption of normal system operation etc. The root cause is that the cryptographic signatures are not properly verified (CWE-347). This is not a completely unauthenticated attack, of course, the attacker must have a foothold first. An authenticated attacker with normal privileges can get a valid signed message from a server, and can send normal and signed XML documents with modified identity information to the verifier, and because of the security defect, the modified identity is accepted, giving the attacker access to sensitive user information and enabling them to mess with the system and its normal usage. Put another way: it's not a high privilege account or a high-privileged credential that unlocks the power of full ID theft, it's an ordinary employee account with low privileges — or a stolen low-privileged account.

Why This Matters for SSO specifically

This bug doesn't just affect one login form. The problem impacts the trust link between XML signature verification and SAML identity consumption, which particularly applies to systems that are implementing SSO, Web Service Security, or Federated authentication. Consider the number of systems that rely on that SAML handshake – HR portals, finance modules, procurement, custom Fiori apps, third-party integrations via Web Services. If the SAML trust boundary is compromised, all systems depending on the trust boundary are compromised.

Scope: Who's Affected?

It's not a weird little edge case bug in a single weird little obscure module. Vulnerability management provider Pathlock has identified the problem as SAP Security Note 3746332 in the SAP NetWeaver ABAP Application Server and ABAP Platform components. The footprint is quite large: the vulnerability exists in a wide range of SAP_BASIS versions (702 to 919). SAP_BASIS 702 stretches back over more than 10 years — and for many organizations that have long-lived, very customized SAP environments (which would represent a considerable portion of enterprise SAP installs), they're in scope.

Case Study: Hypothetical Attack Walkthrough

Let's look at a realistic (illustrative, non-weaponized) attack scenario, based on the published details of the advisories. This scenario involves “GlobalManufacture Corp” who use SAP NetWeaver AS ABAP as the ERP system, with the integration of SAML SSO against their corporate identity provider. As in most big companies, they have thousands of employee accounts (but not admin) including contractors, interns and 3rd party vendor accounts.

Step 1 – Initial Access: A hacker gets access to a low-privilege contractor account, either by phishing or the compromise of a credential that came from an unrelated breach (which unfortunately happens all too often). This account has very few SAP authorizations - it can only read a limited number of non-sensitive reports.

Step 2 — Log in as attacker (normally). In so doing, their browser is presented with a SAML assertion, which is an XML document signed by the IdP, stating “this is contractor_account_42, role = Read-Only User.”

In Step 3, the attacker creates a new XML document that is based on the captured, validly-signed assertion. They wrap the original signed block within another block, and add a forged identity block with a new identity, such as "SAP_ALL admin user" or a finance approver — where SAP's identity verification logic expects to read identity attributes from.

Step 4 – Send to the Verifier The attacker sends this altered document to the SAML consumer endpoint. According to the advisory, if the verifier accepts unsigned or attacker-controlled identity elements, an authenticated low-privileged attacker can get a valid signed SAML/XML message and alter the XML structure to create a signed document that could pass signature validation.

Step 5 — Privilege Escalation The signature check passes (it's checking a real signature — just not on the data that matters). The forged block is read by the identity-consumption logic in SAP, and the session is granted the privileges of the impersonated identity. The impact: It is a contractor's account, minimally privileged, that now has administrator access to finance, HR and procurement modules — and without any password cracking or buffer overflow exploits.

Just XML. As of the time of writing, there is no public proof-of-concept for CVE-2026-44748. The advisory describes a clear attack path, but not a specific version ranges or working attack code is published. This walkthrough describes the attack path used in the advisory for learning purposes only, it is not a working attack.

Why CVE-2026-44748 Wasn't Alone: The Bigger June 2026 Picture

 CVE-2026-44748 didn't arrive in isolation. SAP's June 2026 Patch Tuesday adds another unusually critical one for four HotNews vulnerabilities rated up to CVSS 9.9, two High priority issues, seven Medium priority fixes and two Low priority updates for SAP NetWeaver Application Server ABAP and Java, SAP S/4HANA, SAP Commerce Cloud, SAP Fiori, SAP BusinessObjects BI Platform, SAP Master Data Governance and other application components. Two other important security vulnerabilities were fixed on the same day: A memory corruption vulnerability in the SAP Kernel's RFC protocol handling, known as CVE-2026-27671 (CVSS 9.8).

In contrast to the SAML bug, this one is unauthenticated: An unauthenticated attacker could send a specially crafted RFC request to the application server, and cause logical errors in the kernel memory management structures that lead to buffer overflow, heap overflow, or other conditions of memory corruption. •

CVE-2026-40128 (CVSS 9.0) — Directory traversal vulnerability in the Web Container of SAP NetWeaver AS Java allows an unauthentic user to call up a malicious HTTP logon request with a path traversal sequence to escape from the intended application directory and have the server process an included file. For security teams, the gist: don't pat yourselves on the back, it was a “stop what you are doing” moment for any organization with an SAP deployment.

Detection:

What Do Defenders look for?

While there's no public exploit for CVE-2026-44748, defenders shouldn't wait for one. A practical detection & hardening checklist based on general XSW detection principles and SAP specific monitoring. Audit SAML Assertion Logs for Structural Anomalies. XSW attacks involve duplication of XML elements or unexpectedly nested XML elements. If you are using a SIEM that consumes data from SAML traffic or SAP Security Audit Log (transaction SM20): Look for:

To search for events that are related to SAP Web Services with SAML, see for example the following example: grep -i "SAML" /path/to/sm20_export.log | grep -iE "assertion|signature" For example, if the SAML response contains multiple <Assertion> or <Signature> elements, you can flag them with a different value.If the SAML response has multiple <Assertion> or <Signature> elements, then you may flag them with different values. Using a quick grep against captured SAML XML (# characteristic of XSW payloads) grep -o "<saml:Assertion" suspicious_saml_response.xml | wc -l grep -o "<ds:Signature" suspicious_saml_response.xml | wc -l A valid SAML response will usually include a single signature and assertion.

A number of occurrences, or signatures from an ID that do not match the ID being processed, are red flags. 2. Validate Signature Reference Integrity An important XSW defense is to ensure that the Reference URI of the signature refers to the actual element being processed by the application rather than an element that may validate. As shown in the example above, retrieving the Reference URI from an XML signature for review. xmllint --xpath "//*[local-name()='Reference']/@URI" suspicious_saml_response.xml If this does not match the Reference URI that your application logic reads identity attributes from, there's a good chance that the assertion was altered. 3. Watch out for Privilege Escalation Anomalies Using SAML login events, correlate with subsequent authorization changes – the ultimate goal of this attack is to elevate privileges through impersonation: For example, if you want to cross reference changes to the user master record (table SAP USR04 / AGR_USERS), you can use the following method. Immediately after (SAML based) login of the same user session. SELECT bname, agr_name, modda from agr_users WHERE modda = sy-datum ORDER BY modda DESC.

If a "Read-Only User" account with higher role assignments suddenly appears in the system shortly after completion of an SSO login, it is highly recommended to investigate. 4. Check SAP Trust Center Configuration Review: use transaction SAML2 (or SE80 for custom Web Service consumers): Determine which certificates are set up as trusted signers. The policy for signature validation whether it should be applied to the entire response or just to individual assertions. If the enforcement flags WantAssertionsSigned and equivalent are set properly

Mitigation:

1. Patch first, Harden second The SAP and security community's remediation guidance is clear. Immediate action: apply the SAML XML Signature fix immediately to all SAP_BASIS versions; there is a temporary workaround: Disable SAML authentication, but this is not complete and is not for all used XML Signature applications. Step-by-step mitigation checklist: Install SAP Security Note 3746332 to all SAP_BASIS versions (702–919). With its broad version range, consider a phased rollout beginning with the systems that are internet facing and systems that are critical to SSO.

2. List all SAML dependent systems. Do not think it's "just the login page": Web Services, Fiori launchpads and third-party integrations with SAML assertions are all potential targets. 3. If it's not possible to patch right away, then you can try a temporary solution of turning off SAML authentication on the most vulnerable systems (this is not a patch, but a temporary solution that may affect workflows requiring SSO). 4. Rotate IDP signing certificate when patching, particularly if the attacker has captured any assertions to be signed: This will invalidate any assertions already signed by the attacker. Apply the remaining June 2026 patch as well. Patch all affected SAP Kernel versions (7.22–9.19) to also remove the unauthenticated RFC memory corruption vector (CVE-2026-27671) from the system, as doing so will eliminate CVE-2026-44748. Provide improved SAML/SSO logging and have it reported into your SIEM for continued monitoring post-patch — XSW-style bugs have been a long time in the recurrence as well

There are a number of other lessons to be learned from SAP.Other Lessons: It's Not Just About SAP If you're not running SAP, you should also take some time to learn about how CVE-2026-44748 can be studied as there is a recurring class of vulnerabilities called XML Signature Wrapping that has impacted cloud platforms, identity providers and enterprise software for more than 10 years. The overall answer to this question is relevant for all those creating and managing federated identity systems: Data consumption and signature validation should take place on the same element. This is not the "is there a valid signature somewhere in this document" question, it's the "is this specific data I want to take a certain action on this data, is this data signed?". • Authenticated ≠ harmless. It took only "normal" user privileges to exploit this vulnerability, but it may result in identity impersonation. The login screen is the end of the line for defense in depth. • SSO concentrates risk. Each downstream application that utilizes the trust of one identity provider can become part of a domino effect if the trust provider fails to properly handle the signature. Patch cadence is important — particularly when it comes to ERP. SAP systems are known for their time-consuming testing cycles, the need for maintaining uptime, and custom code that makes them hard to patch quickly. This is the sort of vulnerability that gets exploited when technical details get passed around, and that's what attackers know.

Conclusion

This is a classic case of what "the signature is OK" does not mean in the context of "the data is trustworthy. On the attack side, one of the most difficult stages to overcome when trying to breach an enterprise is simply gaining access — and this vulnerability demonstrates how a hacker may be able to exploit a single low-privilege account, along with a subtlety in XML parsing, to gain access to the organization as a whole. In this week, and not this next quarter, you should make SAP Security Note 3746332 a top priority if your organization is using SAP NetWeaver AS ABAP or ABAP Platform with SAML-based SSO.

 

Sources: SAP Security Patch Day June 2026 advisories, SecurityWeek, BleepingComputer, CSO Online, Pathlock, Layer Seven Security, Onapsis, Red Rays, SOCRadar.