CVE-2026-44762

LowCVSS 3.7/10Last modified Oct 23, 2026

Description

SAP Data Services Management Console allows an overly permissive Content Security Policy (CSP) configuration and lacks certain restrictive directives, which could enable an authenticated malicious user to leverage this weakness in combination with another vulnerability to inject and execute malicious scripts within the application's context. Successful exploitation may result in a low impact on confidentiality and integrity, with no impact on the availability of the application.

Metrics

CVSS 3.1 3.7/10CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-1021

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Aug 11, 2026
Last modified: Oct 23, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-447637.6SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain function CVE-2026-447647.3Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated attacker could send CVE-2026-447657.3Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated remote attacker cou CVE-2026-447666.5SAP S/4HANA (Intercompany Matching and Reconciliation) allows a low-privileged authenticated user to inject malicious input into certain fun CVE-2026-447676.1setThemeRoot() failed to enforce the sap-allowed-theme-origins allowlist. An attacker-controlled absolute cross-origin URL could be stored a CVE-2026-447684.1SAP CRM WebClient UI allows an attacker to inject and execute malicious scripts in the context of the application due to the absence of a Co CVE-2026-447695.5SAP S/4HANA application Project Management (PPM-PRO) allows an attacker with high privileges to execute crafted database queries, exposing t CVE-2026-44773.1A vulnerability was determined in Yi Technology YI Home Camera 2 2.1.1_20171024151200. This affects an unknown function of the component WPA CVE-2026-447704.3SAP Create Single Payment does not perform necessary authorization checks for an authenticated user, a restricted user could access specific CVE-2026-447714.3SAP S/4HANA Draft operation does not perform necessary authorization checks for an authenticated user, a restricted user could access inform CVE-2026-447749.9Traefik is an HTTP reverse proxy and load balancer. Prior to 2.11.46, 3.6.17, and 3.7.1, Traefik's Kubernetes Gateway API provider allows a CVE-2026-447756.9Kavita is a cross platform reading server. Prior to 0.9.0, the ReaderController.GetImage endpoint is decorated with [AllowAnonymous], allowi