CVE-2026-44752
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A vulnerability in SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript via crafted URLs. When a victim accesses such a URL, the script executes in the user's browser, enabling the attacker to access sensitive session information and modify non-sensitive data displayed in the client's browser.
Risk Assessment
The risk for the organization includes potential session theft and data manipulation in user browsers, leading to confidentiality and integrity breaches.
Recommendation
It is recommended to immediately apply patches provided by SAP and implement input filtering and validation mechanisms in web applications.
Other vulnerabilities in SAP NetWeaver Application Server Java
See all- CVE-2026-40128Critical
SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to manipulate parameters in an HTTP logon request, enabling path traversal and processing of the included file. This can lead to reading, modifying, or denying access to data.
- CVE-2026-58235Medium
SAP NetWeaver Application Server Java (Adobe Document Service) uses outdated open source cryptographic and data transfer libraries that contain known vulnerabilities addressed in later versions. A low-privileged authenticated attacker could potentially leverage these weaknesses against the affected component, though no specific exploit is currently known. Successful exploitation could result in low impact on confidentiality, integrity, and availability of the system.
Original NVD description (English source)
SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafted URLs. When a victim accesses such a URL, the script executes in the user's browser, allowing the attacker to access sensitive session information and modify non-sensitive data displayed in the client�s browser. This results in a high impact on confidentiality, low impact on integrity with no impact on availability of the application.