CVE-2026-44757

MediumCVSS 4.7/10Last modified Jul 23, 2026

Description

SAP Wily Introscope Enterprise Manager allows an unauthenticated attacker to craft a specially crafted URL. Under certain conditions, when accessed by a victim, the injected script could execute in the user�s browser within the context of the application. This issue has a low impact on the confidentiality and integrity of the application with no impact on availability.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Jun 9, 2026
Last modified: Jul 23, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-447589.1SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to submit specially crafted input to certain af CVE-2026-447596.1SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflect CVE-2026-44766.3A vulnerability was found in Yi Technology YI Home Camera 2 2.1.1_20171024151200. The impacted element is an unknown function of the file ho CVE-2026-447604.7Due to a Cross-Site Scripting (XSS) vulnerability, applications based on Business Server Pages framework in SAP NetWeaver Application Server CVE-2026-447619.1SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration pro CVE-2026-447623.7SAP Data Services Management Console allows an overly permissive Content Security Policy (CSP) configuration and lacks certain restrictive d CVE-2026-447637.6SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain function CVE-2026-447647.3Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated attacker could send CVE-2026-447657.3Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated remote attacker cou CVE-2026-447666.5SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged authenticated user to inject malicious input into certain fun CVE-2026-447676.1setThemeRoot() failed to enforce the sap-allowed-theme-origins allowlist. An attacker-controlled absolute cross-origin URL could be stored a CVE-2026-447684.1SAP CRM WebClient UI allows an attacker to inject and execute malicious scripts in the context of the application due to the absence of a Co