CVE-2026-44760

MEDIUM

SAP NetWeaver AS ABAP BSP - Cross-Site Scripting

Title source: manual

Description

Due to a Cross-Site Scripting (XSS) vulnerability, applications based on Business Server Pages framework in SAP NetWeaver Application Server ABAP reflects unsanitized input into the HTTP response which allows an attacker to inject and execute arbitrary JavaScript code under certain conditions. Successful exploitation could allow the attacker to steal session information, perform authenticated actions on behalf of the victim user etc. This vulnerability has low impact on confidentiality and integrity of the data and no impact on application 's availability.

References (2)

Core 2

Core References

https://me.sap.com/notes/3754659

https://url.sap/sapsecuritypatchday

Scores

CVSS v3 4.7

EPSS 0.0014

EPSS Percentile 4.0%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-79

Status published

Products (18)

SAP_SE/SAP NetWeaver Application Server ABAP (applications based on Business Server Pages) SAP_BASIS 700

SAP_SE/SAP NetWeaver Application Server ABAP (applications based on Business Server Pages) SAP_BASIS 701

SAP_SE/SAP NetWeaver Application Server ABAP (applications based on Business Server Pages) SAP_BASIS 702

SAP_SE/SAP NetWeaver Application Server ABAP (applications based on Business Server Pages) SAP_BASIS 731

SAP_SE/SAP NetWeaver Application Server ABAP (applications based on Business Server Pages) SAP_BASIS 740

SAP_SE/SAP NetWeaver Application Server ABAP (applications based on Business Server Pages) SAP_BASIS 750

SAP_SE/SAP NetWeaver Application Server ABAP (applications based on Business Server Pages) SAP_BASIS 751

SAP_SE/SAP NetWeaver Application Server ABAP (applications based on Business Server Pages) SAP_BASIS 752

SAP_SE/SAP NetWeaver Application Server ABAP (applications based on Business Server Pages) SAP_BASIS 753

SAP_SE/SAP NetWeaver Application Server ABAP (applications based on Business Server Pages) SAP_BASIS 754

... and 8 more

Published Jul 14, 2026

Tracked Since Jul 14, 2026