AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

SAPCVE-2026-44768

SAP WebClient UI: attacker could inject

SAP

CVE-2026-44768 · Published Jul 14, 2026 · updated Nov 10, 2026

Medium4.1
No fix yet
SAP advisory

SAP WebClient UI allows an attacker to inject and execute malicious scripts in the context of the application due to the absence of a Content Security Policy (CSP) configuration for certain restrictive directives. This vulnerability has a low impact on the integrity of the application. Confidentiality and availability are not impacted.

Affected versions

PackageAffectedFixed in
SAP WebClient UI
Product
<= S4FND 104No fix yet
<= 105No fix yet
<= 106No fix yet

Changes since it was listed

SummaryNov 10Summary: SAP CRM WebClient UI allows an attacker to inject and execute malicious scripts in the context of the application due to to SAP WebClient UI allows an attacker to inject and execute malicious scripts in the context of the application due to the absence of a Content Security Policy (C
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
Severity from
the vendor (its own CVE record or advisory)
Weakness
CWE-15

More SAP advisories

All SAP
Critical 9.1Jul 14SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented...CVE-2026-44761no fix yetMedium 6.1Jul 14SAP @ui5/webcomponents-base: clickjackingCVE-2026-44767no fix yetMedium 5.5Jul 14SAP S/4HANA Project Management (PPM-PRO): SQL injectionCVE-2026-44769no fix yetMedium 4.3Jul 14SAP S/4 HANA (Create Single Payment): missing authorizationCVE-2026-44770no fix yetMedium 4.3Jul 14SAP S/4HANA (Draft operation): privilege escalationCVE-2026-44771no fix yetHigh 7.6Jul 14SAP Change and Transport System Attach Tool (ctsattach): unsafe deserializationCVE-2026-58233no fix yet