CVE-2026-76976: Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)
Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain functionality, allowing an authenticated attacker to send malicious content to another user. If the victim interacts with the affected content, malicious scripts could be executed in the victim's browser context. This vulnerability has a low impact on the confidentiality and integrity of the data and no impact on the availability of the application.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Organizations using SAP NetWeaver Application Server ABAP applications based on SAP GUI for HTML are affected by the described issue. Exploitation targets users who receive and interact with malicious content sent by an authenticated attacker.
What does an attacker need to exploit it?
The attacker needs authenticated access and must be able to send malicious user-supplied content to another user. The victim must then interact with that content in their browser.
Does exploitation affect availability?
No. The reported impact is limited to low confidentiality and integrity impact, with no availability impact.
How can we determine whether we are affected?
Review whether your SAP NetWeaver Application Server ABAP environment runs applications based on SAP GUI for HTML and uses the affected functionality. SAP Note 3671819 is provided as the vendor reference for this vulnerability.