CVE-2026-44748Patch

LOWCVSS 9.9 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modified signed XML documents to the verifier. This may result in acceptance of tampered identity information leading to unauthorized access to sensitive user data and potential disruption of normal system usage. This causes a high impact on confidentiality, integrity and availability of the application.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-347

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

DECLINING

Threat summary

Patch or workaround signal is available
18 mentions across 6 observed days
Momentum state: declining

What's happening

Patch or workaround mentioned in 12 signals
Technical details provided in 14 signals
Disclosure: 5 classified signals
General: 1 classified signal
Peaked 5d ago at 9 mentions (2026-06-09); latest day: 1
18 total mentions across 6 days

Deep dive

Activity timeline18 mentions / 6d

Signal classification3 categories

Patch

1266.7%

Disclosure

527.8%

General

15.6%

Referenced assets11 URLs

By indicator

Classification over time

Date	Total	Labels

2026-06-09	9	Disclosure1Patch8
2026-06-10	3	Disclosure2Patch1
2026-06-11	2	Disclosure1Patch1
2026-06-15	2	Patch2
2026-07-01	1	General1
2026-07-07	1	Disclosure1

Full discourse18 posts

Cybersecurity News Everyday@TweetThreatNews136d
Patch
SAP released 15 June 2026 security notes, including 4 critical fixes for NetWeaver, Commerce Cloud, and Data Hub. CVE-2026-44748 in NetWeaver AS ABAP scores 9.9 and impacts XML Signature Wrapping. #SAP #NetWeaver #CommerceCloud https://ift.tt/enJ1Vz8
Post summary
SAP’s June 15th security notes disclose critical fixes for several products, including a high‑score CVE affecting XML Signature Wrapping; the advisory details the vulnerability and the available patch.
00021119
4.4K followersView on X
Cybersecurity News Everyday@TweetThreatNews135d
Patch
SAP's June 2026 patch fixes 15 flaws, including 4 critical issues in NetWeaver and Commerce Cloud. CVE-2026-44748 and CVE-2026-27671 may enable auth bypass, memory corruption, and directory traversal. #SAP #NetWeaver #CommerceCloud https://ift.tt/SjWas2O
Post summary
The post announces SAP’s June 2026 patch that addresses 15 CVEs, including CVE-2026-44748 and CVE-2026-27671, which could lead to authentication bypass, memory corruption, and directory traversal.
00011135
4.4K followersView on X
CCB Alert@CCBalert136d
Patch
Warning: #SAP has released security updates for 15 vulnerabilities in several of their products, including 4 critical vulnerabilities: #CVE-2026-44748; #CVE-2026-27671; #CVE-2026-40128 and #CVE-2026-22732. Read our advisory here: https://ccb.belgium.be/advisories/warning-sap-addresses-critical-vulnerabilities-affecting-multiple-sap-products-patch #Patch #Patch #Patch
Post summary
SAP announced that security patches have been released for 15 vulnerabilities, including four critical CVEs, as detailed in their advisory.
02000141
7.2K followersView on X
Orizon@OrizonCyber136d
Patch
🚨 CVE-2026-44748 — CVSS 9.9/10 ██████████ SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/QkbkF2xXiX
Post summary
The tweet announces the discovery of CVE-2026-44748, notes its critical severity, and urges immediate patching.
10010134
59 followersView on X
Jacek Bugajski@DzejBi_JB108d
Disclosure
4/ Napastnik potrzebuje otwartych drzwi. SAP je dostarczył. Ostatni cykl not: - CVE-2026-44748 (9.9): obejście SAML w NetWeaver ABAP - CVE-2026-27671 (9.8): memory corruption w RFC, BEZ workaroundu Plus supply-chain z maja: złośliwe pakiety npm w CAP na BTP (CVE-2026-46421)
Post summary
The post announces three newly disclosed SAP CVEs, detailing a SAML bypass, a memory‑corruption flaw, and a supply‑chain issue, without providing PoC, exploit code, or patch information.
1000077
338 followersView on X
كاسبر سكاي@KasperskyDev130d
Patch
ثغرة حرجة في خوادم ساب تتيح للمهاجم تزوير الهوية وتجاوز المصادقة بالكامل المعرّف : CVE-2026-44748 درجة الخطورة : 9.9 (CVSS) - Critical الإصدارات المتأثرة : SAP NetWeaver AS ABAP / ABAP Platform الحل : Apply SAP Note 3746332 #CVE #SAP #CyberSecurity #CVE202644748
Post summary
A critical SAP NetWeaver authentication bypass (CVE‑2026‑44748) is disclosed, with a high CVSS score and an explicit patch number (SAP Note 3746332) recommended for remediation.
0100079
40.0K followersView on X
Xavier Rivera@XavierRiveraX135d
Disclosure
SAP June 2026 Patch Day: CVE-2026-44748 (CVSS 9.9) in NetWeaver ABAP SAML. Low-priv attackers with a valid signed message can replay tampered XML to bypass identity checks. Affects SAP_BASIS 702 through 919. Four critical CVEs total across NetWeaver and Commerce Cloud.
Post summary
The post announces a high‑severity vulnerability discovered in SAP NetWeaver ABAP SAML and informs of its inclusion in the upcoming Patch Day, focusing on the disclosure of the CVE details.
01000128
559 followersView on X
CyberAlertsHQ@CyberAlertsHQ136d
Patch
🚨 NEW: SAP June Patch Day — 4 critical flaws, top CVSS 9.9. The worst: CVE-2026-44748 lets a low-privileged user forge SAML assertions and bypass authentication entirely on NetWeaver ABAP. CVE-2026-27671 (CVSS 9.8) is unauthenticated memory corruption via crafted RFC requests — potential RCE with no workaround, kernel update required. Also critical: CVE-2026-40128 (CVSS 9.0) unauthenticated directory traversal on NetWeaver Java, and CVE-2026-22732 (CVSS 9.1) unauthenticated Spring Security bypass in Commerce Cloud. SAP runs the back-end of most of the world's largest enterprises. No in-the-wild exploitation confirmed yet — patch now before that changes. Full breakdown 👇 https://www.bleepingcomputer.com/news/security/sap-fixes-critical-flaws-in-netweaver-and-commerce-cloud/
Post summary
SAP has released critical patches for multiple CVEs, urging immediate remediation before any in‑the‑wild exploitation can occur.
1000084
77 followersView on X
Upwind Security MDR@UpwindMDR136d
Patch
🚨Critical - Two SAP NetWeaver Flaws Patched in June 2026 (CVE-2026-44748, CVE-2026-40128) SAP's June 2026 Security Patch Day fixes two critical SAP NetWeaver vulnerabilities, both with a scope change and full C/I/A impact. CVE-2026-44748 (9.9) - AS ABAP and ABAP Platform: an Improper Verification of Cryptographic Signature flaw (CWE-347). An authenticated attacker with normal privileges can take a valid signed message, tamper with the signed XML, and have the verifier accept forged identity information, leading to unauthorized access to sensitive data. CVE-2026-40128 (9.0) - AS Java Web Container: a path traversal / file inclusion flaw (CWE-35). An unauthenticated attacker sends a crafted HTTP logon request that manipulates file inclusion parameters to escape the intended directory and process an arbitrary local file, leading to disclosure or modification of sensitive data or DoS. Neither has a public PoC yet, but both are network-reachable and one needs no authentication at all. 👉Apply SAP Security Notes 3746332 and 3727078 (SAP June 2026 Security Patch Day).
Post summary
SAP released a June 2026 patch day fixing two critical NetWeaver CVEs; the vulnerabilities are described in technical detail but lack public PoCs or evidence of exploitation, and users are directed to apply the relevant SAP Security Notes.
00010150
210 followersView on X
IntegSec@integ_sec114d
General
CVE-2026-44748: SAP NetWeaver SAML Authentication Bypass - What It Means for Your Business and How to Respond https://hubs.li/Q04nfgzT0
Post summary
The provided text is a headline linking to an article about CVE‑2026‑44748; it contains no concrete details, PoC, exploit, patch, or claim of active exploitation.
0000036
31 followersView on X
SecAlerts@SecAlertsCo130d
Patch
🔐 SAP NetWeaver AS ABAP hit with a SAML XML Signature Wrapping flaw (CVE-2026-44748, CVSS 9.9). Authenticated users can forge signed XML docs to bypass auth controls — critical scope impact across C/I/A. Patch via SAP Note 3746332. #SAP #AppSec https://secalerts.co/vulnerability/CVE-2026-44748 https://t.co/WyBHLdQ5cS
Post summary
The tweet announces a high‑scoring CVE-2026-44748 vulnerability in SAP NetWeaver AS ABAP and provides vendor patch details via SAP Note 3746332.
00000102
835 followersView on X
Daily Security Review@securitydailyr134d
Patch
SAP June Patch Day: 15 security notes, 4 critical. CVE-2026-44748 (CVSS 9.9) — XML Signature Wrapping bypass in NetWeaver SAML. CVE-2026-27671 (CVSS 9.8) — unauthenticated memory corruption in ABAP RFC gateway. https://dailysecurityreview.com/resources/sap-patches-cvss-9-9-saml-flaw-and-abap-memory-corruption/ #CyberSecurity #Vulne https://t.co/vngyJitU2z
Post summary
The tweet announces SAP's June Patch Day, highlighting two critical CVEs with high CVSS scores and linking to resources that likely contain patch information.
0000047
118 followersView on X
ThreatAft@ThreatAft134d
Disclosure
🔐 CVE-2026-44748: Critical XML Signature Wrapping in SAP NetWeaver (CVSS 9.9). Authenticated attacker with normal privileges can bypass SAML authentication, forge identity, and escalate privileges. 🔗 https://threataft.com/articles/cve-2026-44748-sap-netweaver-xml-signature-wrapping #CyberSecurity #CVE202644748 #SAP #NetWeaver #SAML
Post summary
The post announces the discovery of a high‑severity XML Signature Wrapping vulnerability in SAP NetWeaver that allows authenticated attackers to bypass SAML authentication and elevate privileges.
0000054
29 followersView on X
Israel@f1tym1135d
Disclosure
SAP Security Patch Day June 2026: Critical CVE-2026-44748 SAML Flaw Could Allow Full Authentication Bypass https://ift.tt/Hc6WAJ1 SAP Security Patch Day June 2026: Critical CVE-2026-44748 SAML Flaw Could Allow Full Authentication Bypass On June 9, 2026, SAP released its mont…
Post summary
The post announces the release of SAP Security Patch Day June 2026, highlighting the critical CVE‑2026‑44748 SAML flaw that could enable a full authentication bypass; no PoC, exploit code, or active exploitation details are shared.
0000034
993 followersView on X
Cyber Threat Observatory | Alan Turing Institute@TuringCyberObs135d
Disclosure
CVE-2026-44748 (SAP NetWeaver) is a critical XML signature-verification flaw affecting versions 702–919. Authenticated users may alter signed XML content and have it incorrectly accepted as authentic See full analysis: https://github.com/alan-turing-institute/cyber-threat-observatory/blob/main/reports/2026-06-09/TIER_2_CVE-2026-44748.md #CyberSecurity #SAP #ApplicationS
Post summary
The post announces a critical XML signature verification flaw (CVE-2026-44748) in SAP NetWeaver, detailing affected versions and impact, and references a technical report but provides no PoC, exploit, patch, or activity confirmation.
0000035
51 followersView on X
TECHEPAGES@techepages135d
Patch
⚠️ SAP patches 15 vulnerabilities on June Patch Day — including a near-perfect 9.9 CVSS flaw. SAP's June 2026 Security Patch Day delivered 15 new security notes addressing vulnerabilities across its product portfolio. The most severe — CVE-2026-44748 (CVSS 9.9) — is an XML Signature Wrapping vulnerability in SAML Authentication affecting SAP NetWeaver AS ABAP and ABAP Platform.
Post summary
The post announces SAP’s release of 15 patches, highlighting the high‑severity CVE‑2026‑44748 XML signature wrapping flaw in NetWeaver and confirms that vendor fixes are available.
0000034
10 followersView on X
CyberAlertsHQ@CyberAlertsHQ136d
Patch
🚨 UPDATE — CVE-2026-44748 SAP NetWeaver: No in-the-wild exploitation yet — no public PoC either. But the patch footprint is massive: SAP_BASIS versions 702 through 919 are all affected, spanning 20+ years of deployments. Most enterprise SAP environments will need multiple systems patched. Key interim step confirmed by Onapsis: disabling SAML authentication neutralizes CVE-2026-44748, but doesn't cover all signed XML use cases. No workaround exists for CVE-2026-27671 — kernel update required. Prior SAP NetWeaver critical flaws were weaponized within days. Clock is ticking. 👇 https://www.bleepingcomputer.com/news/security/sap-fixes-critical-flaws-in-netweaver-and-commerce-cloud/
Post summary
The announcement focuses on the extensive patch coverage for CVE-2026-44748 and the interim mitigation of disabling SAML authentication, with no evidence of current exploitation or detailed vulnerability description.
00000207
77 followersView on X
ThreatCluster@threatcluster136d
Patch
SAP released 15 security notes addressing four critical flaws including CVE-2026-44748 and CVE-2026-27671 in NetWeaver and other core products, Belgium's Centre for Cybersecurity said. https://threatcluster.io/cluster/sap-issues-urgent-patches-for-critical-vulnerabilities-in-co-edb02464
Post summary
SAP has released urgent patches for four critical flaws, including CVE-2026-44748 and CVE-2026-27671, that affect NetWeaver and other core products.
0000049
318 followersView on X

Explore more

Back to dashboard

What researchers are saying

CVE-2026-44748

Cybersecurity News Everyday[verified]@TweetThreatNewsPatch

SAP’s June 15th security notes disclose critical fixes for several products, including a high‑score CVE affecting XML Signature Wrapping; the advisory details the vulnerability and the available patch.

Cybersecurity News Everyday[verified]@TweetThreatNewsPatch

The post announces SAP’s June 2026 patch that addresses 15 CVEs, including CVE-2026-44748 and CVE-2026-27671, which could lead to authentication bypass, memory corruption, and directory traversal.

Orizon[verified]@OrizonCyberPatch

The tweet announces the discovery of CVE-2026-44748, notes its critical severity, and urges immediate patching.

Jacek Bugajski[verified]@DzejBi_JBDisclosure

The post announces three newly disclosed SAP CVEs, detailing a SAML bypass, a memory‑corruption flaw, and a supply‑chain issue, without providing PoC, exploit code, or patch information.

Xavier Rivera[verified]@XavierRiveraXDisclosure

The post announces a high‑severity vulnerability discovered in SAP NetWeaver ABAP SAML and informs of its inclusion in the upcoming Patch Day, focusing on the disclosure of the CVE details.

CyberAlertsHQ[verified]@CyberAlertsHQPatch

SAP has released critical patches for multiple CVEs, urging immediate remediation before any in‑the‑wild exploitation can occur.

Upwind Security MDR[verified]@UpwindMDRPatch

SAP released a June 2026 patch day fixing two critical NetWeaver CVEs; the vulnerabilities are described in technical detail but lack public PoCs or evidence of exploitation, and users are directed to apply the relevant SAP Security Notes.

IntegSec[verified]@integ_secGeneral

The provided text is a headline linking to an article about CVE‑2026‑44748; it contains no concrete details, PoC, exploit, patch, or claim of active exploitation.