SAP NetWeaver ABAP XSS Improper Input Sanitization
CVE-2026-44760 Published on July 14, 2026

Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on Business Server Pages)
Due to a Cross-Site Scripting (XSS) vulnerability, applications based on Business Server Pages framework in SAP NetWeaver Application Server ABAP reflects unsanitized input into the HTTP response which allows an attacker to inject and execute arbitrary JavaScript code under certain conditions. Successful exploitation could allow the attacker to steal session information, perform authenticated actions on behalf of the victim user etc. This vulnerability has low impact on confidentiality and integrity of the data and no impact on application 's availability.

NVD

Vulnerability Analysis

CVE-2026-44760 is exploitable with network access, requires user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.

Attack Vector:
NETWORK
Attack Complexity:
HIGH
Privileges Required:
NONE
User Interaction:
REQUIRED
Scope:
CHANGED
Confidentiality Impact:
LOW
Integrity Impact:
LOW
Availability Impact:
NONE

Weakness Type

What is a XSS Vulnerability?

The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVE-2026-44760 has been classified to as a XSS vulnerability or weakness.


Products Associated with CVE-2026-44760

Want to know whenever a new CVE is published for SAP Netweaver Application Server Abap? stack.watch will email you.

SAP Netweaver Application Server Abap
 

Affected Versions

SAP_SE SAP NetWeaver Application Server ABAP (applications based on Business Server Pages):