CVE-2026-76976
Received Received - Intake

Stored XSS in SAP NetWeaver via SAP GUI for HTML

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: SAP SE

Description
Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain functionality, allowing an authenticated attacker to send malicious content to another user. If the victim interacts with the affected content, malicious scripts could be executed in the victim's browser context. This vulnerability has a low impact on the confidentiality and integrity of the data and no impact on the availability of the application.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-76976
EUVD
EUVD-2026-98187

Affected Vendors & Products

Showing 12 associated CPEs
Vendor Product Version / Range
SAP_SE SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML) SAP_BASIS 731
SAP_SE SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML) SAP_BASIS 740
SAP_SE SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML) SAP_BASIS 750
SAP_SE SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML) SAP_BASIS 751
SAP_SE SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML) SAP_BASIS 752
SAP_SE SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML) SAP_BASIS 753
SAP_SE SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML) SAP_BASIS 754
SAP_SE SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML) SAP_BASIS 755
SAP_SE SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML) SAP_BASIS 756
SAP_SE SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML) SAP_BASIS 757
SAP_SE SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML) SAP_BASIS 758
SAP_SE SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML) SAP_BASIS 816

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects SAP GUI for HTML in SAP NetWeaver Application Server ABAP. It allows an authenticated attacker to send malicious content to another user. If the victim interacts with the content, malicious scripts could execute in their browser.

Detection Guidance

Detecting this vulnerability requires checking for improper input sanitization in SAP GUI for HTML applications. Monitor browser console logs for unexpected script execution or unusual network requests. Review SAP application logs for unauthorized content delivery. Use SAP's built-in security tools to scan for cross-site scripting (XSS) patterns in user-supplied input.

Impact Analysis

An attacker could trick you into interacting with malicious content, leading to script execution in your browser. This could compromise your data confidentiality and integrity, though availability remains unaffected.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, potentially violating GDPR (data protection) or HIPAA (health data privacy) requirements. Organizations must address it to maintain compliance.

Mitigation Strategies

Apply SAP's official patch from SAP Note 3671819 immediately. Disable or restrict SAP GUI for HTML functionality if not required. Implement input validation and output encoding in all user-supplied content. Configure Content Security Policy (CSP) headers to mitigate XSS risks. Train users to avoid interacting with suspicious content.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-76976. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart