SAP NetWeaver Application Server ABAP and ABAP Platform allow an authenticated attacker with normal privileges to obtain a valid signed message and send modified signed XML documents to the verifier. This would cause the verifier to accept tampered identity information, leading to unauthorized access to sensitive user data and potential disruption of system usage. The flaw is classified as a high‑impact XML Signature Wrapping issue (CWE‑347) that compromises confidentiality, integrity, and availability of the application.

The vulnerability affects SAP NetWeaver AS ABAP and ABAP Platform. Specific affected release versions are not disclosed in the available data, so all installations of these products should be considered at risk until an official patch is applied.

The CVSS score of 9.9 indicates critical severity, and although the EPSS score is not available, the lack of exploitation mitigation in KEV suggests the issue is not yet widely exploited in the wild. The attack requires a legitimate authenticated session with normal privileges, implying that attackers with such access can modify the XML signature without detection. Once a signed message is captured, the attacker can replay or alter the data, causing the system to trust forged identity assertions. The nature of the weakness (XML Signature Wrapping) allows the attacker to bypass normal signature verification procedures by restructuring the XML prior to verification, a technique known to be feasible with many existing XML parsers.