CVE-2025-26659

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

SAP NetWeaver Application Server ABAP does not sufficiently encode user-controlled inputs, leading to DOM-basedCross-Site Scripting (XSS) vulnerability. This allows an attacker with no privileges, to craft a malicious web message that exploits WEBGUI functionality. On successful exploitation, the malicious JavaScript payload executes in the scope of victim�s browser potentially compromising their data and/or manipulating browser content. This leads to a limited impact on confidentiality and integrity. There is no impact on availability

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
SAP_SE	SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML)	KRNL64UC 7.53; KERNEL 7.53; KERNEL 7.54; KERNEL 7.77; KERNEL 7.89; KERNEL 7.93; KERNEL 9.14

References

Timeline

Published: Mar 11, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-266604.3SAP Fiori applications using the posting library fail to properly configure security settings during the setup process, leaving them at defa CVE-2025-266618.8Due to missing authorization check, SAP NetWeaver (ABAP Class Builder) allows an attacker to gain higher access levels than they should have CVE-2025-266624.4The Data Services Management Console does not sufficiently encode user-controlled inputs, allowing an attacker to inject malicious script. W CVE-2025-266638.1Use after free in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.CVE-2025-266646.5Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.CVE-2025-266657.0Sensitive data storage in improperly locked memory in Windows upnphost.dll allows an authorized attacker to elevate privileges locally.CVE-2025-266667.8Heap-based buffer overflow in Windows Media allows an authorized attacker to execute code locally.CVE-2025-266676.5Exposure of sensitive information to an unauthorized actor in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attack CVE-2025-266687.5Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a networ CVE-2025-266698.8Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a networ CVE-2025-26674.9IBM Sterling B2B Integrator 6.0.0.0 through 6.1.2.7_1 and 6.2.0.0 through 6.2.0.4 and IBM Sterling File Gateway 6.0.0.0 through 6.1.2.7_1 an CVE-2025-266708.1Use after free in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to execute code over a network.