CVE-2026-76958
Received Received - Intake

XML External Entity Processing in SAP Integration Suite

Publication date: 2026-09-08

Last updated on: 2026-09-08

Assigner: SAP SE

Description
SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity declarations. Successful exploitation could allow the attacker to read sensitive file contents from the server and expose them through monitoring or logging output, resulting in a high impact on confidentiality. It could also lead to resource exhaustion, causing a low impact on availability. There is no impact on integrity.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-08
Last Modified
2026-09-08
Generated
2026-09-08
AI Q&A
2026-09-08
EPSS Evaluated
N/A
NVD
CVE-2026-76958
EUVD
EUVD-2026-72578

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
sap integration_suite *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-611 The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SAP Integration Suite fails to properly validate XML documents from untrusted sources. An attacker with low privileges could send crafted XML with malicious external entity declarations. This could let them read sensitive server files through monitoring or logs, affecting confidentiality. It may also cause resource exhaustion, impacting availability but not integrity.

Detection Guidance

Detecting this vulnerability requires checking for XML external entity (XXE) processing in SAP Integration Suite. Monitor for unusual XML parsing errors or excessive file access logs. Use network traffic analysis tools like Wireshark to inspect XML payloads for external entity declarations. Enable detailed logging in SAP Integration Suite to capture XML processing events and look for anomalies.

Impact Analysis

An attacker could access confidential data stored on the server by exploiting this flaw. They might also disrupt services by consuming excessive resources, leading to downtime or degraded performance. However, they cannot alter or corrupt data.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies
  • Disable DTD processing in XML parsers used by SAP Integration Suite to prevent XXE attacks.
  • Apply input validation to restrict XML payloads to expected formats and block external entity declarations.
  • Update SAP Integration Suite to the latest version or apply patches provided by SAP to address the vulnerability.
  • Restrict network access to SAP Integration Suite components to trusted sources only.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76958. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart