CVE-2026-44757

MediumCVSS 4.7

Published: 09/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

5th percentile - higher than 5% of all known CVEs

Summary

SAP Wily Introscope Enterprise Manager allows an unauthenticated attacker to craft a specially crafted URL. Under certain conditions, when accessed by a victim, the injected script could execute in the user's browser within the application context. Low impact on confidentiality and integrity, no impact on availability.

Risk Assessment

XSS attack may allow session data theft or content manipulation, but risk is limited due to low impact.

Recommendation

Apply the patch provided by SAP for SAP Wily Introscope Enterprise Manager. Restrict access to trusted users only.

Other vulnerabilities in SAP Wily Introscope Enterprise Manager

CVE-2026-0500Critical
Vulnerability in SAP Wily Introscope Enterprise Manager (WorkStation) due to a vulnerable third-party component. An unauthenticated attacker can create a malicious JNLP file accessible via a public URL, and a victim clicking it could lead to OS command execution on the victim's machine.

Original NVD description (English source)

SAP Wily Introscope Enterprise Manager allows an unauthenticated attacker to craft a specially crafted URL. Under certain conditions, when accessed by a victim, the injected script could execute in the user�s browser within the context of the application. This issue has a low impact on the confidentiality and integrity of the application with no impact on availability.