SAP NetWeaver AS ABAP SAML2 authentication bypass lets unauthenticated attackers impersonate users (CVE-2026-120017)

What happened

SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming SAML2 authentication assertions under certain configurations. An unauthenticated attacker can submit specially crafted data to bypass authentication and impersonate arbitrary users, including privileged accounts.

The attack is reachable over the network without credentials and without user interaction. Successful exploitation can fully compromise the application's confidentiality, integrity and availability, with a scope change meaning the impact can extend to connected components and systems beyond the affected system.

There is no published indication of active exploitation or public disclosure at the time of this advisory.

Who is affected

The affected product is SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider). Affected SAP_BASIS releases: SAP_BASIS 702, SAP_BASIS 731, SAP_BASIS 740, SAP_BASIS 750, SAP_BASIS 751, SAP_BASIS 752, SAP_BASIS 753, SAP_BASIS 754. The issue occurs under certain configurations; confirm whether your systems use the SAML2 service provider. These components typically underpin SAP application servers and can be central to ERP and other SAP workloads.

What to do now

1. Treat affected systems as unauthenticated risk until SAP publishes a fix. No fixed release is listed yet.
2. Confirm whether you run an affected SAP_BASIS release with the SAML2 service provider enabled, and inventory those systems.
3. Restrict network access to affected systems to trusted hosts and networks. Do not expose the SAML2 service provider to untrusted networks.
4. Review SAML2 service provider logs for successful authentication by privileged or unexpected accounts, particularly from unusual source networks.
5. Monitor SAP Security Patch Day and SAP's security note for a fix or vendor guidance.

How to detect it

Review SAML2 service provider logs for successful authentication events by privileged or unexpected accounts, especially from unfamiliar source networks or IP ranges. SAP has not published specific indicators of compromise for this issue at the time of this advisory.

Beyond the patch

CVE-2026-120017 is a pre-authentication, network-reachable authentication bypass in SAP's core application server. Until a fix exists, knowing where affected systems sit and whether the SAML2 endpoint is reachable is the only practical control. Virtual CISO Services can establish exposure management so unauthenticated SAP endpoints are found before they are exploited, and SAP HANA Security & Cloud Migration can review SAML2 service provider configuration across your SAP estate.