SAP CRM WebClient UI CSP Bypass Allows XSS Injection
CVE-2026-44768 Published on July 14, 2026
Security misconfiguration in SAP CRM (WebClient UI)
SAP CRM WebClient UI allows an attacker to inject and execute malicious scripts in the context of the application due to the absence of a Content Security Policy (CSP) configuration for certain restrictive directives. This vulnerability has a low impact on the integrity of the application. Confidentiality and availability are not impacted.
Vulnerability Analysis
CVE-2026-44768 is exploitable with network access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality, with no impact on integrity, and no impact on availability.
Weakness Type
External Control of System or Configuration Setting
One or more system settings or configuration elements can be externally controlled by a user. Allowing external control of system settings can disrupt service or cause an application to behave in unexpected, and potentially malicious ways.
Products Associated with CVE-2026-44768
Want to know whenever a new CVE is published for SAP Crm Webclient Ui? stack.watch will email you.
Affected Versions
SAP_SE SAP CRM (WebClient UI):- Version S4FND 104 is affected.
- Version 105 is affected.
- Version 106 is affected.