CVE-2026-44762
Received Received - Intake

Content Security Policy Bypass in SAP Data Services

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: SAP SE

Description
SAP Data Services Management Console allows an overly permissive Content Security Policy (CSP) configuration and lacks certain restrictive directives, which could enable an authenticated malicious user to leverage this weakness in combination with another vulnerability to inject and execute malicious scripts within the application's context. Successful exploitation may result in a low impact on confidentiality and integrity, with no impact on the availability of the application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-44762
EUVD
EUVD-2026-55862

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sap data_services_management_console *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1021 The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves SAP Data Services Management Console having an overly permissive Content Security Policy (CSP) configuration. This means the application lacks certain restrictive CSP directives, allowing an authenticated malicious user to potentially inject and execute malicious scripts within the application's context. This could be combined with another vulnerability to increase the risk.

Detection Guidance

Detection of this vulnerability requires checking the Content Security Policy (CSP) configuration of SAP Data Services Management Console for overly permissive settings or missing restrictive directives. Review the CSP headers in HTTP responses for directives like script-src, object-src, or default-src that may allow unsafe sources. No specific commands are provided in the context.

Impact Analysis

If exploited, this vulnerability may lead to low impact on confidentiality and integrity of data within the application. It does not affect the availability of the application. An attacker could potentially steal or manipulate data if they combine this with another vulnerability.

Compliance Impact

This vulnerability may impact compliance with GDPR and HIPAA due to potential unauthorized script execution leading to data confidentiality breaches. Low impact on confidentiality and integrity could violate GDPR's data protection requirements or HIPAA's safeguards for protected health information.

Mitigation Strategies

Review and strengthen the Content Security Policy (CSP) configuration for SAP Data Services Management Console by adding restrictive directives. Ensure CSP headers are properly set to prevent script injection. Limit user permissions to the minimum required for functionality.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-44762. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart