CVE-2026-89122
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component. An unauthenticated attacker could craft a malicious link that, when clicked by a victim, loads attacker-controlled content within the trusted application context, potentially allowing tracking of user information and defacement of parts of the page.
Risk Assessment
An attacker may track users and modify displayed content, with low impact on confidentiality and integrity, but undermining trust in the portal.
Recommendation
Apply available SAP updates for NetWeaver Enterprise Portal and implement input validation in the portal component.
Other vulnerabilities in SAP NetWeaver Enterprise Portal
See all- CVE-2026-89118Medium
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information. This leads to low impact on confidentiality, with no impact on integrity and availability.
- CVE-2026-89117Medium
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, potentially leading to session information theft, portal content manipulation, or user redirection.
- CVE-2026-44759Medium
A vulnerability in SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited.
- CVE-2025-42872Medium
XSS vulnerability in SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts that execute in the context of other users' browsers, enabling theft of session cookies, tokens, and other sensitive information. The impact on confidentiality and integrity is low, and no impact on availability.
- CVE-2025-42884Medium
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject JNDI environment properties or pass a URL used during JNDI lookup operations, enabling access to an unintended JNDI provider. This could further lead to disclosure or modification of information about the server. There is no impact on availability.
- CVE-2023-33985Medium
SAP NetWeaver Enterprise Portal version 7.50 does not sufficiently encode user-controlled inputs over the network, resulting in reflected Cross-Site Scripting (XSS) vulnerability. Successful exploitation allows an attacker to view or modify information, causing limited impact on confidentiality and integrity of the application.
Original NVD description (English source)
SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component. An unauthenticated attacker could craft a malicious link that, when clicked by a victim, loads attacker-controlled content within the trusted application context. Successful exploitation could allow the attacker to track user information and deface parts of the rendered page, resulting in a low impact on confidentiality and integrity with no impact on availability.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS