CVE-2026-66779: Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP

Published Aug 11, 2026

Updated

Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP, an authenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated victim accesses this link, the injected input is processed and reflected within the DOM on the client side during page rendering, resulting in the execution of malicious content in the victim's browser context. Successful exploitation could result in a high impact to the confidentiality and a low impact to the integrity of the system, while availability remains unaffected.

Affected Software

1 affected component

SAP SAP NetWeaver Application Server ABAP

Event History

Aug 11, 2026

CVE Published

via MITRE·12:20 AM

Data Sourced

via MITRE·12:20 AM

DescriptionSeverity

Data Sourced

via NVD·01:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the severity of CVE-2026-66779?

The severity of CVE-2026-66779 is assessed as medium with a score of 6.3.

How does CVE-2026-66779 affect SAP NetWeaver Application Server ABAP?

CVE-2026-66779 affects SAP NetWeaver Application Server ABAP by allowing an authenticated attacker to perform Cross-Site Scripting (XSS) attacks.

How do I fix CVE-2026-66779?

To fix CVE-2026-66779, apply the latest security patches provided by SAP for SAP NetWeaver Application Server ABAP.

Who is affected by CVE-2026-66779?

Authenticated users of SAP NetWeaver Application Server ABAP are primarily affected by CVE-2026-66779.

What type of attack is CVE-2026-66779 related to?

CVE-2026-66779 is related to Cross-Site Scripting (XSS) attacks.