CVE-2026-120017: SAP NetWeaver SAML2 Bypass
Critical CVSS (10.0) reachable over network.
TL;DR - CVE-2026-120017 is a CVSS 10.0 authentication-bypass flaw in SAP NetWeaver AS ABAP and ABAP Platform SAML2 Service Provider functionality. - Unauthenticated attackers may impersonate arbitrary users, including privileged accounts. - No confirmed public PoC or in-the-wild exploitation was identified at the time of review. - Exposed systems should be patched urgently using SAP Security Note 3849308.
CVE-2026-120017 is a critical SAP NetWeaver vulnerability involving insufficient verification of incoming SAML authentication assertions. The flaw affects SAP NetWeaver AS ABAP and ABAP Platform deployments using the SAML2 Service Provider functionality. Organizations should validate their SAP_BASIS release, support-package level, SAML2 configuration, and network exposure immediately.
Are You Affected?
CVE-2026-120017 affects the SAML2 Service Provider functionality in SAP NetWeaver AS ABAP and ABAP Platform. The vulnerability is classified as CWE-347, Improper Verification of Cryptographic Signature.
| Field | Details |
|---|---|
| CVE ID | CVE-2026-120017 |
| CVSS | 10.0, critical |
| Attack vector | Network |
| Authentication required | None |
| User interaction | None indicated |
| Affected component | SAML2 Service Provider |
| Patch available | Vendor correction is referenced; exact fixed version must be obtained from SAP Security Note 3849308 |
| CISA KEV | No, not listed at the time of review |
| Vendor | SAP SE |
The CNA-associated affected release identifiers include the following SAP_BASIS versions:
- SAP_BASIS 702
- SAP_BASIS 731
- SAP_BASIS 740
- SAP_BASIS 750
- SAP_BASIS 751
- SAP_BASIS 752
- SAP_BASIS 753
- SAP_BASIS 754
- SAP_BASIS 755
- SAP_BASIS 756
- SAP_BASIS 757
- SAP_BASIS 758
- SAP_BASIS 816
- SAP_BASIS 920
- SAP_BASIS 921
- SAP_BASIS 922
The available research data does not provide precise support-package ranges or a fixed SAP_BASIS version. Administrators must validate their exact release, patch level, and SAML2 configuration against SAP Security Note 3849308.
A release should not be considered safe merely because it is absent from a general product inventory. The affected component and support-package level are decisive.
For context on related vulnerability-triage practices, see our coverage of CVE-2026-116692.
The Fix, If You’re in a Hurry
The vendor remediation reference is SAP Security Note 3849308:
https://me.sap.com/notes/3849308
SAP’s support portal requires authentication, and the exact corrected component version or minimum support-package level was not available in the public record reviewed for this article. This article therefore cannot responsibly state a specific fixed version number. Treat the SAP note as the authoritative source for the required correction and release-specific implementation instructions.
Prioritize internet-facing SAP systems and systems that expose SAML2 authentication to untrusted networks. Confirm whether the affected SAML2 Service Provider functionality is enabled, identify all configured identity providers, and coordinate an emergency change through the SAP Basis and identity teams.
Technical Notes: Mitigation Commands and Procedures
Use SAP-supported tools and change procedures rather than applying an arbitrary package. A typical operational workflow is:
1. Open SAP for Me and locate SAP Security Note 3849308.
2. Record the required correction for the installed SAP_BASIS release.
3. Download the applicable support package, correction instruction, or transport.
4. Implement it through the organization's SAP maintenance process.
5. Verify the corrected component and repeat SAML authentication tests.
For inventory and validation, administrators can use System > Status in SAP to record the installed SAP_BASIS release and support-package level. In SAP Solution Manager or SAP Cloud ALM environments, use the organization’s established software inventory and security-note compliance process.
The exact transaction, package, and implementation sequence may vary by deployment and must follow SAP’s instructions.
If immediate patching is impossible:
- Restrict access to affected SAML2 endpoints to trusted network paths.
- Disable unused SAML2 Service Provider configurations.
- Require compensating controls at an approved reverse proxy or web application firewall.
- Monitor authentication and identity-provider logs closely.
- Establish a documented emergency-change plan for applying the SAP correction.
These measures reduce risk but do not replace the SAP correction. Avoid broadly disabling authentication controls without an approved emergency plan, because doing so can create additional exposure.
How This Vulnerability Works
CVE-2026-120017 affects the processing of authentication assertions by the SAP NetWeaver SAML2 Service Provider. SAML assertions carry identity and authorization claims from an identity provider to a service provider. Before establishing a session, a service provider must verify both the cryptographic signature and the assertion’s context.
The reported weakness is inadequate verification of incoming authentication assertions. In practical terms, the SAML2 Service Provider may accept authentication data that is forged, improperly signed, or insufficiently bound to the expected identity provider and service-provider context. The associated weakness, CWE-347, specifically concerns improper verification of cryptographic signatures.
An unauthenticated attacker who can reach the relevant authentication surface may submit specially crafted data. If the assertion is accepted, the attacker may be treated as an arbitrary user, potentially including a privileged account. The resulting access could affect confidentiality, integrity, and availability, and may extend to connected systems that trust the compromised SAP deployment.
Technical Notes: Assertion-Validation Controls
A correctly configured SAML implementation generally needs to validate more than the presence of an XML signature. Defensive review should include:
- Signature validity using the expected trusted identity-provider certificate.
- Issuer identity and trust relationship.
- Audience restriction for the intended service provider.
- Recipient and destination values.
- Assertion and subject-confirmation timestamps.
- Replay resistance and assertion identifiers.
- NameID and attribute mapping.
- Conditions and authentication context.
- Certificate rotation and trust-store configuration.
Do not attempt to “fix” the vulnerability by manually accepting only assertions containing selected user attributes. Attribute filtering can reduce authorization risk, but it does not replace cryptographic and contextual validation in the vendor correction.
Analyst’s Take: Patch priority should follow exposure, not the current absence of a public PoC or CISA KEV listing. Internet-facing systems with SAML2 enabled warrant the fastest review because the flaw requires neither authentication nor user interaction and may allow privileged-user impersonation.
Severity, Explained
The NVD record reports a CVSS base score of 10.0, the maximum CVSS severity. The available research data does not include the complete CVSS vector string, so a formal vector should not be reconstructed or published without confirmation from the full NVD or vendor record.
The available characteristics explain the critical rating:
| CVSS characteristic | Reported or inferred significance |
|---|---|
| Attack vector | Network-reachable authentication functionality |
| Attack complexity | The description does not identify a complex prerequisite |
| Privileges required | None |
| User interaction | None indicated |
| Confidentiality | High potential impact through unauthorized account access |
| Integrity | High potential impact through impersonation and unauthorized changes |
| Availability | High potential impact through compromise of application operations |
| Scope | Potential effects may extend to connected systems |
The most important operational factor is the combination of network reachability and no required authentication. An attacker does not need an existing SAP account before attempting exploitation. If a privileged identity can be impersonated, the attacker may gain access equivalent to that account, making downstream authorization controls less effective.
CVSS does not measure whether a particular installation is internet-facing, whether SAML2 is enabled, or how valuable the affected SAP system is to the organization. Assess asset exposure, identity-provider trust, administrative privileges, and connected-system integrations separately.
Is It Being Exploited?
CVE-2026-120017 was not listed in CISA’s Known Exploited Vulnerabilities catalog at the time of review. Consequently, CISA has not assigned a KEV date-added value, due date, required action, or ransomware-campaign designation for this CVE.
No independently verified in-the-wild exploitation was identified in the reviewed research. Absence from KEV does not prove that exploitation has never occurred. KEV inclusion depends on CISA’s cataloging process and available evidence; it is not a universal telemetry feed.
No confirmed public proof of concept was identified in the reviewed sources. The research also found no confirmed Exploit-DB entry, Metasploit module, or Nuclei template for this CVE. Because the issue involves an authentication bypass with a maximum CVSS score, defenders should not wait for a public exploit before patching or reviewing logs.
The current evidence status is therefore:
| Question | Status |
|---|---|
| Confirmed active exploitation | Not identified |
| CISA KEV listing | No |
| Public PoC | Not identified |
| Exploit-DB entry | Not identified |
| Metasploit module | Not identified |
| Nuclei template | Not identified |
Detecting It in Your Environment
Detection should combine SAP application logs, identity-provider logs, web or reverse-proxy telemetry, and account activity. The goal is to identify suspicious SAML authentication attempts, unexpected assertion subjects, malformed requests, and successful logons that do not match normal user behavior.
Prioritize systems where the SAML2 Service Provider is enabled and reachable from the internet or broad partner networks. Review successful logons for privileged accounts, especially when the source network, user agent, time, or identity-provider context is unusual.
Correlate SAP logon events with identity-provider records. A successful SAP session without a corresponding legitimate identity-provider authentication event warrants investigation.
For a related explanation of immutable audit records and their role in preserving evidence, see What Is an Immutable Log?.
Technical Notes: Log Patterns and Detection Queries
Exact SAP log field names vary by release and logging configuration, so treat the following patterns as starting points rather than universal signatures. Search web, SAP security, and identity-provider logs for SAML-related requests and assertion-processing failures:
"SAML" AND ("assertion" OR "Response" OR "SubjectConfirmation")
"SAML" AND ("signature" OR "certificate" OR "issuer" OR "audience")
"SAML" AND ("invalid" OR "failed" OR "rejected" OR "expired" OR "replay")
A generic SIEM query for suspicious privileged access can be adapted as follows:
index=sap OR index=proxy OR index=idp
("SAML" OR "SAMLResponse" OR "assertion")
| eval privileged=if(match(user, "(?i)^(SAP\\*|DDIC|SYSTEM|ADMIN)"), 1, 0)
| where privileged=1
| stats count min(_time) as first_seen max(_time) as last_seen
values(src_ip) as source_ips
values(user_agent) as user_agents
by user, host
| sort -count
Review for these indicators:
- A privileged SAP account authenticated through SAML without a matching identity-provider event.
- Multiple identities or NameID values originating from one unusual source.
- Assertions with unexpected issuer, audience, recipient, or destination values.
- Repeated signature-validation failures followed by a successful privileged logon.
- Authentication from a source address or user agent not associated with the user or identity provider.
- Sudden access to administration transactions after a new SAML session.
Network controls can also help identify exposure. Inventory reverse-proxy routes and firewall rules that permit access to SAP SAML endpoints.
Do not rely on a simple string-based network signature to confirm exploitation. SAML requests are often encoded and may be transported over HTTPS. Decryption and application-aware logging, where legally and operationally appropriate, provide stronger visibility.
If suspicious activity is found, preserve SAP application logs, web-server logs, identity-provider audit records, proxy logs, and relevant session or access records before rotation. Investigate potentially impersonated accounts and consider credential, session, certificate, and trust-configuration review according to the incident-response plan.
Response Priorities for Security Teams
If your organization may be affected, use the following sequence:
- Identify exposure. Inventory SAP NetWeaver systems, SAP_BASIS versions, support-package levels, SAML2 configurations, reverse proxies, and internet-facing routes.
- Consult SAP. Review SAP Security Note 3849308 through SAP for Me and determine the required release-specific correction.
- Reduce access. Restrict exposed SAML2 endpoints and disable unused configurations while the patch is being prepared.
- Patch through change control. Apply the vendor-approved correction, support package, or transport.
- Validate authentication. Test legitimate SAML flows, signature validation, issuer and audience checks, privileged-account controls, and connected integrations.
- Review logs. Investigate suspicious assertions, privileged sessions, identity-provider mismatches, and unexpected administrative activity.
- Document results. Record affected assets, remediation status, compensating controls, and evidence reviewed.
References and Further Reading
The primary remediation reference is SAP Security Note 3849308:
https://me.sap.com/notes/3849308
Administrators should use the authenticated SAP note to obtain the exact affected support-package ranges, correction instructions, and fixed component level. Because those details were not available in the public response reviewed here, the note—not a third-party summary—should determine the implementation target.
SAP’s Security Patch Day information is available at:
https://url.sap/sapsecuritypatchday
The NVD CVE API record is:
https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=CVE-2026-120017
Additional records containing affected-version data and research summaries include:
- OpenCVE: https://app.opencve.io/cve/CVE-2026-120017
- CVE Todo: https://cvetodo.com/cve/CVE-2026-120017
Start with SAP Security Note 3849308 and verify each installed SAP_BASIS release and support-package level. For exposed systems, reduce SAML2 access while the correction is being coordinated, then review authentication and identity-provider logs for signs of privileged-account impersonation.
The lack of confirmed exploitation does not offset the combination of unauthenticated network access, potential privileged-user impersonation, and a CVSS 10.0 rating.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.