This vulnerability (CVE-2026-44748) in SAP NetWeaver AS ABAP and ABAP Platform is due to improper verification of cryptographic signatures (CWE-347). An attacker with valid authentication but normal privileges can manipulate signed XML documents and have them accepted by the system, bypassing signature validation. This can result in acceptance of altered identity information, enabling unauthorized access and possible disruption of system functionality. The CVSS v3.1 base score is 9.9, reflecting critical severity with network attack vector, low attack complexity, privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation information is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows an authenticated user with normal privileges to bypass cryptographic signature verification, leading to acceptance of tampered identity data. This can result in unauthorized access to sensitive information and potential disruption of system availability and integrity. The impact affects confidentiality, integrity, and availability at a high level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided, organizations should monitor SAP advisories closely for updates. Until a patch is available, restrict authenticated user privileges as much as possible and review usage of signed XML documents within the affected SAP components to limit exposure.