CVE-2026-109810: CSS Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java)
SAP NetWeaver Application Server Java (Web Dynpro Java) does not sufficiently validate certain request parameters used to resolve styling resources in the application. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated victim, causes the victim's browser to load attacker-controlled styling content within the trusted application context. Successful exploitation could allow the attacker to redress the trusted user interface for phishing purposes and exfiltrate limited web page content, resulting in a low impact on confidentiality and integrity. There is no impact on availability.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Authenticated users of SAP NetWeaver Application Server Java applications using Web Dynpro Java are the intended targets. An unauthenticated attacker can initiate the attack, but exploitation requires an authenticated victim to click a crafted malicious link.
What does an attacker need to exploit it?
The attacker needs to craft a link containing malicious request parameters and persuade an authenticated user to open it. No attacker authentication is required, but user interaction is required.
What can successful exploitation achieve?
The attacker can cause attacker-controlled styling content to load in the trusted application context, enabling user-interface redressing for phishing and limited web page content exfiltration. The reported impact is limited to confidentiality and integrity; availability is not affected.