CVE-2026-44759

MediumCVSS 6.1/10Last modified Oct 24, 2026

Description

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal content, or user redirection, resulting in a low impact on the application's confidentiality and integrity, with no impact on availability.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
SAP_SE	SAP NetWeaver Enterprise Portal	EP-RUNTIME 7.50

References

Timeline

Published: Jul 14, 2026
Last modified: Oct 24, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-44766.3A vulnerability was found in Yi Technology YI Home Camera 2 2.1.1_20171024151200. The impacted element is an unknown function of the file ho CVE-2026-447604.7Due to a Cross-Site Scripting (XSS) vulnerability, applications based on Business Server Pages framework in SAP NetWeaver Application Server CVE-2026-447619.1SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration pro CVE-2026-447623.7SAP Data Services Management Console allows an overly permissive Content Security Policy (CSP) configuration and lacks certain restrictive d CVE-2026-447637.6SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain function CVE-2026-447647.3Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated attacker could send CVE-2026-447657.3Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated remote attacker cou CVE-2026-447666.5SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged authenticated user to inject malicious input into certain fun CVE-2026-447676.1setThemeRoot() failed to enforce the sap-allowed-theme-origins allowlist. An attacker-controlled absolute cross-origin URL could be stored a CVE-2026-447684.1SAP WebClient UI allows an attacker to inject and execute malicious scripts in the context of the application due to the absence of a Conten CVE-2026-447695.5SAP S/4HANA application Project Management (PPM-PRO) allows an attacker with high privileges to execute crafted database queries, exposing t CVE-2026-44773.1A vulnerability was determined in Yi Technology YI Home Camera 2 2.1.1_20171024151200. This affects an unknown function of the component WPA