Vulnerability details
CVE-2026-44752
SAP_SE SAP NetWeaver Application Server Java
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java(Configuration Wizard)
CVSS 3.1
8.2High
Official description
SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafted URLs. When a victim accesses such a URL, the script executes in the user's browser, allowing the attacker to access sensitive session information and modify non-sensitive data displayed in the client�s browser. This results in a high impact on confidentiality, low impact on integrity with no impact on availability of the application.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 8.2High | 3.1 | CVEProject cvelistV5 (CNA) (sap) | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| SAP_SE | SAP NetWeaver Application Server Java(Configuration Wizard) | LMCTC 7.50 | CVEProject cvelistV5 (CNA) |
References and advisories
2
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-07-14
- Last updated
- 2026-07-14
- State
- Published
- Assigner (CNA)
- sap
Exploit prediction (EPSS)
0.36%
Probability of exploitation in 30 days
29.9%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- None
- Technical impact
- Partial
Weaknesses (CWE)
- CWE-79Improper Neutralization of Input During Web Page Generation