CVE-2026-120016: Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Visual Composer
SAP NetWeaver Visual Composer does not perform sufficient input validation and output encoding on certain request data. An unauthenticated attacker could craft a malicious link containing specially crafted input. If a victim clicks the link, the injected script executes in the victim's browser within the context of the affected application. This results in a low impact on confidentiality and integrity. There is no impact on availability.
Affected Software
Event History
Frequently Asked Questions
Who needs to interact with an exploit for it to succeed?
A victim must click a malicious link crafted by an unauthenticated attacker. The attack is delivered through request data and executes in the victim's browser in the context of the affected application.
Does exploitation require an account or prior access?
No. The attacker does not need authentication or privileges, but exploitation requires user interaction because a victim must click the crafted link.
What is the expected impact if exploitation succeeds?
The injected script can have low-impact effects on confidentiality and integrity in the affected application's browser context. The vulnerability has no availability impact.