CVE-2026-89117: Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal content, or user redirection. This results in a low impact on confidentiality and integrity. There is no impact on availability.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker does not need to authenticate, but must persuade a user to visit a crafted URL containing the malicious parameter. Exploitation requires user interaction because the script runs when the URL is opened in the user's browser.
Who is exposed to the attack?
Users who visit an attacker-crafted URL targeting an SAP NetWeaver Enterprise Portal instance are exposed. The resulting script execution occurs in the visiting user's browser and can enable session-information theft, portal-content manipulation, or redirection.
Does this vulnerability affect availability?
No. The reported impact is limited to low confidentiality and integrity impact; no availability impact is identified.