CVE-2026-89122
Received Received - Intake

SAP NetWeaver Enterprise Portal Reflected XSS

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: SAP SE

Description
SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component. An unauthenticated attacker could craft a malicious link that, when clicked by a victim, loads attacker-controlled content within the trusted application context. Successful exploitation could allow the attacker to track user information and deface parts of the rendered page, resulting in a low impact on confidentiality and integrity with no impact on availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-13
Last Modified
2026-10-13
Generated
2026-10-13
AI Q&A
2026-10-13
EPSS Evaluated
N/A
NVD
CVE-2026-89122
EUVD
EUVD-2026-98201

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
SAP_SE SAP NetWeaver Enterprise Portal EP-RUNTIME 7.50

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-601 The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

SAP NetWeaver Enterprise Portal has a flaw where input to a specific portal component is not properly validated. An attacker can create a malicious link that, when clicked by a user, injects attacker-controlled content into the trusted application. This allows tracking user information and altering parts of the displayed page.

Detection Guidance

This vulnerability involves crafted links exploiting SAP NetWeaver Enterprise Portal. Detection requires monitoring for unusual portal requests or content modifications. Check SAP logs for unexpected input in portal components and inspect network traffic for suspicious links targeting the portal. No specific commands are provided in the context.

Impact Analysis

An attacker could use this to steal user data, such as session cookies or personal information, by tracking user activity. They could also deface parts of the portal page, making it appear as if the site is compromised or misleading users with false information.

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations may face compliance penalties if user data is exposed due to this flaw.

Mitigation Strategies

Apply the latest security patches from SAP as referenced in SAP Note 3790401. Ensure input validation is enforced in the portal component and restrict access to untrusted links. Monitor for unusual portal activity or defacement attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-89122. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart