What is CVE-2026-44748?

CVE-2026-44748 is a critical-severity vulnerability in SAP Se Netweaver As Abap And Platform, classified under Improper Verification of Cryptographic Signature. CVSS score: 9.9/10. Published 2026-06-09.

How severe is CVE-2026-44748?

Critical severity. CVSS v3 base score is 9.9 out of 10.

Vulnerability in SAP Se Netweaver As Abap And Platform

CVE-2026-44748

SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modified signed XML documents to the verifier. This may result in acceptance of tampered identity information leading to unauthorized access to sensitive user data and potential disruption of normal system usage. This causes a high impact on confidentiality, integrity and availability of the application.

Published 2026-06-09 · last modified 2026-07-23.

CVSS v3 metric

CVSS v3 base score 9.9 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.

EPSS exploit prediction

EPSS: 0.003 (22.5th percentile), scored 2026-09-29.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 22nd percentile — 22.5% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.002 · newest: 0.003 · change: +0.001

Affected products

SAP Se Netweaver As Abap And Platform — versions SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740

Weakness classification (CWE)

CWE-347 — Improper Verification of Cryptographic Signature

References

Frequently asked questions

What is CVE-2026-44748?: CVE-2026-44748 is a critical-severity vulnerability in SAP Se Netweaver As Abap And Platform, classified under Improper Verification of Cryptographic Signature. CVSS score: 9.9/10. Published 2026-06-09.
How severe is CVE-2026-44748?: Critical severity. CVSS v3 base score is 9.9 out of 10.