CVE-2026-76976

Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)

State: Published
Severity: 5.4 Medium
Published: Oct 13, 2026
Updated: Oct 13, 2026
Reserved: Aug 20, 2026

Read the record on cve.org

Description

Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain functionality, allowing an authenticated attacker to send malicious content to another user. If the victim interacts with the affected content, malicious scripts could be executed in the victim's browser context. This vulnerability has a low impact on the confidentiality and integrity of the data and no impact on the availability of the application.

Scores

CVSS	Score	Vector	Source
3.1	5.4 Medium	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N	sap

Weaknesses

CWE-79 Improper Neutralization of Input During Web Page Generation

Affected Products

Product	Versions
SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)SAP_SE	SAP_BASIS 731Affected SAP_BASIS 740Affected SAP_BASIS 750Affected SAP_BASIS 751Affected SAP_BASIS 752Affected SAP_BASIS 753Affected SAP_BASIS 754Affected SAP_BASIS 755Affected SAP_BASIS 756Affected SAP_BASIS 757Affected SAP_BASIS 758Affected SAP_BASIS 816Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.