CVE-2026-44759

MediumCVSS 6.1

Published: 14/07/2026(UTC)Updated: 14/07/2026(UTC)Translated: 16/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

7th percentile - higher than 7% of all known CVEs

Summary

A vulnerability in SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited.

Risk Assessment

This attack can lead to session information theft, portal content manipulation, or user redirection, impacting the application's confidentiality and integrity, with no impact on availability.

Recommendation

It is recommended to immediately apply patches provided by SAP and implement input validation and encoding mechanisms for URL parameters.

Other vulnerabilities in SAP NetWeaver Enterprise Portal

CVE-2023-33985Medium
SAP NetWeaver Enterprise Portal version 7.50 does not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripting (XSS) vulnerability. Successful exploitation allows an attacker to view or modify information, causing limited impact on confidentiality and integrity of the application.

Original NVD description (English source)

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal content, or user redirection, resulting in a low impact on the application's confidentiality and integrity, with no impact on availability.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS