CVE-2026-44759 | SAP NetWeaver Enterprise Portal allows an unauthenticated at… | CVSS 6.1 MEDIUM

Description

SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal content, or user redirection, resulting in a low impact on the application's confidentiality and integrity, with no impact on availability.

Metadata

CVE ID: CVE-2026-44759
State: PUBLISHED
Assigner: sap
Reserved: 2026-05-07 18:31 UTC
Published: 2026-07-14 00:20 UTC
Last updated: 2026-07-14 00:20 UTC
Primary CWE: CWE-79
CWE-79: Improper Neutralization of Input During Web Page Gen…
Vendor / Product: SAP_SE / SAP NetWeaver Enterprise Portal
Sources: cve.org · NVD

Severity & Metrics

6.1 MEDIUM CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Affected products (1)

Vendor	Product	Platform	Versions
SAP_SE	SAP NetWeaver Enterprise Portal	—	EP-RUNTIME 7.50

Weakness (CWE)

CWE	Source	Description
CWE-79	cna	CWE-79: Improper Neutralization of Input During Web Page Generation

CVSS scores (1)

Score	Severity	Version	Source	Vector
6.1	MEDIUM	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References (2)