CVE-2026-66779
Received Received - Intake

XSS Vulnerability in SAP NetWeaver Application Server ABAP

Publication date: 2026-08-11

Last updated on: 2026-08-11

Assigner: SAP SE

Description
Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP, an authenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated victim accesses this link, the injected input is processed and reflected within the DOM on the client side during page rendering, resulting in the execution of malicious content in the victim's browser context. Successful exploitation could result in a high impact to the confidentiality and a low impact to the integrity of the system, while availability remains unaffected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-11
Generated
2026-08-11
AI Q&A
2026-08-11
EPSS Evaluated
N/A
NVD
CVE-2026-66779
EUVD
EUVD-2026-55891

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sap netweaver_application_server_abap *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP. An authenticated attacker can create a malicious link that, when accessed by another authenticated user, executes malicious code in the victim's browser. The injected input is reflected in the DOM during page rendering, leading to potential security risks.

Detection Guidance

Detection of this XSS vulnerability in SAP NetWeaver Application Server ABAP requires manual review of web application inputs and outputs. Check for improperly sanitized user inputs in URL parameters, form fields, or headers that are reflected in the DOM without proper encoding. Use browser developer tools to inspect DOM elements for unexpected scripts or payloads. Review server logs for unusual requests containing script tags or event handlers.

Impact Analysis

If exploited, this vulnerability could allow an attacker to steal sensitive data, such as session cookies or personal information, compromising the confidentiality of the system. It may also lead to unauthorized actions being performed on behalf of the victim, though integrity impact is low and availability remains unaffected.

Compliance Impact

This vulnerability could lead to breaches of confidentiality, which may violate GDPR's data protection requirements or HIPAA's safeguards for protected health information. Organizations using SAP NetWeaver Application Server ABAP may face compliance risks if the vulnerability is exploited and sensitive data is compromised.

Mitigation Strategies

Apply SAP security notes or patches addressing XSS vulnerabilities in NetWeaver Application Server ABAP. Review and sanitize user inputs to prevent malicious script injection. Implement Content Security Policy (CSP) headers to mitigate XSS impact. Monitor SAP notes for updates and restrict access to sensitive functions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-66779. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart