ctipilot.ch

SAP NetWeaver AS ABAP SAML XML Signature Wrapping (CVSS 9.9), SAP_BASIS 702-919

cve · CVE-2026-44748 single-source

Coverage timeline
2
first 2026-06-10 → last 2026-06-14
Peak priority
high
1 high · 1 notable
Sources cited
5
5 hosts
Sections touched
2
trending-vulnerabilities, weekly-vuln-rollup
Co-occurring entities
3
see Related entities below
ATT&CK techniques
0
no mapped behavior yet

Hunting pivots

Tags
auth-bypass ×2vulnerabilities ×2identitypre-auth

Story timeline

  1. 2026-06-14CVE-2026-44748 — SAP NetWeaver AS ABAP: SAML XML Signature Wrapping (CVSS 9.9)
    weekly-vuln-rollup
  2. 2026-06-10CVE-2026-44748 — SAP June Patch Day: SAML XML Signature Wrapping in NetWeaver AS ABAP (CVSS 9.9) plus an unauth RFC kernel memory-corruption (CVSS 9.8)
    trending-vulnerabilities

Where this entity is cited

  • trending-vulnerabilities1
  • weekly-vuln-rollup1

Source distribution

  • bleepingcomputer.com1 (20%)
  • ccb.belgium.be1 (20%)
  • onapsis.com1 (20%)
  • security-hub.ncsc.admin.ch1 (20%)
  • support.sap.com1 (20%)

Co-occurring entities

Derived — referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

External references

NVD · cve.org · CISA KEV

All cited sources (5)

Entries about SAP NetWeaver AS ABAP SAML XML Signature Wrapping (CVSS 9.9), SAP_BASIS 702-919 (2)

2026-06-14 · view entry permalink →

NOTABLECVE-2026-44748

CVE-2026-44748 — SAP NetWeaver AS ABAP: SAML XML Signature Wrapping (CVSS 9.9)

SAP's June Patch Day (9 June) shipped multiple HotNews notes; the most severe affect NetWeaver AS ABAP and the ABAP Platform — the ERP backbone across Swiss federal/cantonal administration and EU public-sector finance. CVE-2026-44748 (CVSS 9.9) is a SAML XML Signature Wrapping flaw, paired with an unauthenticated RFC kernel memory-corruption bug (CVSS 9.8) (Onapsis; daily 06-10). Signature-wrapping bugs let an attacker forge an assertion that passes signature validation while carrying attacker-chosen identity content — an authentication bypass against SAML-federated logins. Apply the June HotNews notes; for SAML federation, verify the patched NetWeaver enforces strict assertion-to-signature binding, and hunt for logons with valid-but-anomalous assertion structure.

vulnerability14 Jun 23:57Zsingle-sourceOpen finding ↗
Sources: Onapsis

2026-06-10 · view entry permalink →

HIGHCVE-2026-44748 +3

CVE-2026-44748 — SAP June Patch Day: SAML XML Signature Wrapping in NetWeaver AS ABAP (CVSS 9.9) plus an unauth RFC kernel memory-corruption (CVSS 9.8)

SAP's June Patch Day (9 June) shipped multiple HotNews notes; the most severe affect NetWeaver AS ABAP and ABAP Platform — the ERP backbone across Swiss federal/cantonal administration and EU public-sector bodies (Onapsis, 2026-06-09). CVE-2026-44748 (CVSS 9.9) is an XML Signature Wrapping flaw in the SAML authentication handler: an attacker takes a legitimately-signed SAML assertion and replaces the processed element with attacker-controlled identity data while leaving the signature valid, enabling privilege escalation/account takeover. It spans SAP_BASIS 702–919, an unusually broad patch footprint (NCSC-CH, 2026-06-09). CVE-2026-27671 (CVSS 9.8) is memory corruption via improper RFC protocol validation reachable unauthenticated over the network; CVE-2026-40128 (CVSS 9.0) is a path traversal in the NetWeaver AS Java Web Container; CVE-2026-22732 (CVSS 9.1) is a missing-security-headers bug in Spring Security affecting Commerce Cloud/Data Hub (SAP, 2026-06-09). Exploitation is listed UNKNOWN for all four. Apply the June SAP Security Notes (SAP Note 3746332 is the SAML XSW fix for CVE-2026-44748) and enable RFC gateway ACLs (gw/acl_mode=1) and SNC to reduce the RFC-kernel exposure. CCB Belgium issued a parallel public-sector "patch now" advisory (CCB, 2026-06-09).

vulnerability10 Jun 05:00Zmulti-sourceOpen finding ↗
Sources: Onapsis, 2026-06-09 · NCSC-CH, 2026-06-09 · SAP, 2026-06-09 · BleepingComputer, 2026-06-09