CVE-2026-76972
Received Received - Intake

Stored XSS in SAP Manufacturing Integration and Intelligence

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: SAP SE

Description
Due to a Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later rendered by the application. If an authenticated victim accesses a page that displays this stored content, the injected input is processed during web page generation, resulting in the execution of malicious content in the victim�s browser context. This could allow the attacker to access or modify information within the victim�s browser scope. Successful exploitation could allow the attacker to access session information, modify rendered page content and disrupt the victim's use of the application, resulting in a low impact on confidentiality, integrity and availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-76972
EUVD
EUVD-2026-98185

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
SAP_SE SAP Manufacturing Integration and Intelligence XMII 15.4
SAP_SE SAP Manufacturing Integration and Intelligence 15.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence. An attacker can store malicious content that gets rendered by the application. When an authenticated user views the page containing this content, the malicious script executes in their browser, potentially accessing or modifying information within their session.

Detection Guidance

Detecting this XSS vulnerability typically involves inspecting web application inputs and outputs for malicious scripts. Check application logs for unusual input patterns or payloads. Use browser developer tools to monitor network requests and responses for unencoded or improperly sanitized inputs. Scan web pages for stored content that may execute scripts when rendered.

Impact Analysis

If exploited, this vulnerability could allow attackers to access session information, modify page content, or disrupt the application's functionality for victims. The impact is rated as low for confidentiality, integrity, and availability.

Compliance Impact

This XSS vulnerability could lead to unauthorized access or modification of sensitive data within a user's browser, potentially violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. The low impact on confidentiality and integrity may still result in compliance breaches depending on the data processed.

Mitigation Strategies

Apply the latest security patches from SAP as referenced in SAP Note 3798823. Implement input validation to sanitize user inputs and output encoding to prevent script execution. Configure Content Security Policy (CSP) headers to restrict inline scripts. Monitor application logs for suspicious activity and restrict user permissions to minimize impact.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76972. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart