CVE-2026-27682
Reflected XSS in SAP NetWeaver Application Server ABAP
Publication date: 2026-05-12
Last updated on: 2026-05-12
Assigner: SAP SE
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| sap | netweaver_application_server_abap | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a reflected cross-site scripting (XSS) issue in SAP NetWeaver Application Server ABAP, specifically in applications based on Business Server Pages. An attacker who is not authenticated can create a specially crafted URL that includes malicious script code within an unprotected URL parameter. When a victim clicks this URL, the malicious script is executed in the victim's browser during the web page generation process.
How can this vulnerability impact me? :
The impact of this vulnerability includes the attacker being able to execute malicious scripts in the victim's browser context. This can lead to unauthorized access to or modification of information within the affected application, thereby compromising the confidentiality and integrity of the data. However, this vulnerability does not affect the availability of the application.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by identifying attempts to exploit reflected cross-site scripting (XSS) in SAP NetWeaver Application Server ABAP by monitoring for suspicious URLs containing unprotected parameters with embedded scripts.
Common detection methods include analyzing web server logs for unusual URL parameters or payloads that contain script tags or JavaScript code.
Specific commands or tools to detect such activity are not provided in the available resources.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include avoiding clicking on suspicious links that may exploit the vulnerability and applying any available patches or updates from SAP for the NetWeaver Application Server ABAP.
Since the vulnerability involves unprotected URL parameters, implementing input validation and output encoding on the affected application can help prevent script injection.
No specific mitigation commands or detailed steps are provided in the available resources.