AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

SAPCVE-2026-44760

SAP NetWeaver Application Server: cross-site scripting

SAP

CVE-2026-44760 · Published Jul 14, 2026

Medium4.7
No fix yet
SAP advisory

Due to a Cross-Site Scripting (XSS) vulnerability, applications based on Business Server Pages framework in SAP NetWeaver Application Server ABAP reflects unsanitized input into the HTTP response which allows an attacker to inject and execute arbitrary JavaScript code under certain conditions. Successful exploitation could allow the attacker to steal session information, perform authenticated actions on behalf of the victim user etc. This vulnerability has low impact on confidentiality and integrity of the data and no impact on application 's availability.

Affected versions

PackageAffectedFixed in
SAP NetWeaver Application Server ABAP (applications based on Business Server Pages)
Product
<= SAP_BASIS 700No fix yet
<= SAP_BASIS 701No fix yet
<= SAP_BASIS 702No fix yet
<= SAP_BASIS 731No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-79

More SAP advisories

All SAP
Critical 9.1Jul 14SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented...CVE-2026-44761no fix yetMedium 6.1Jul 14SAP @ui5/webcomponents-base: clickjackingCVE-2026-44767no fix yetMedium 4.1Jul 14SAP WebClient UI: attacker could injectCVE-2026-44768no fix yetMedium 5.5Jul 14SAP S/4HANA Project Management (PPM-PRO): SQL injectionCVE-2026-44769no fix yetMedium 4.3Jul 14SAP S/4 HANA (Create Single Payment): missing authorizationCVE-2026-44770no fix yetMedium 4.3Jul 14SAP S/4HANA (Draft operation): privilege escalationCVE-2026-44771no fix yet