CVE-2026-44759— Cross Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal
Possible ATT&CK Techniques 2AI
T1059 · Command and Scripting Interpreter T1189 · Drive-by CompromiseAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| SAP_SE | SAP NetWeaver Enterprise Portal | EP-RUNTIME 7.50 | affected |
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-44759
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cross Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal
Source: CVE Program / CVE List V5
Vulnerability Description
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal content, or user redirection, resulting in a low impact on the application's confidentiality and integrity, with no impact on availability.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Vulnerability Title
SAP NetWeaver Enterprise Portal 跨站脚本漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
SAP NetWeaver Enterprise Portal是德国SAP公司的一个 SAP NetWeaver的 Web 前端组件。 SAP NetWeaver Enterprise Portal EP-RUNTIME 7.50版本存在跨站脚本漏洞，该漏洞源于允许未经验证的攻击者向URL参数注入恶意脚本，这些脚本被反射回服务器响应中，在用户访问特制URL时在浏览器中执行，导致会话信息窃取、门户内容操纵或用户重定向，对应用的机密性和完整性造成低影响，对可用性无影响。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SAP_SE | SAP NetWeaver Enterprise Portal | EP-RUNTIME 7.50 | - |
II. Public POCs for CVE-2026-44759
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-44759
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-44759 (1)
Same Patch Batch · SAP_SE · 2026-07-14 · 15 CVEs total
| CVE-2026-44747 | 9.9 CRITICAL | Memory Corruption vulnerability in SAP NetWeaver Application Server ABAP |
| CVE-2026-27690 | 9.1 CRITICAL | HTTP Request Smuggling in SAP Approuter |
| CVE-2026-44761 | 9.1 CRITICAL | Insecure Sample Credentials in SAP Commerce Cloud |
| CVE-2026-0487 | 8.4 HIGH | DLL Hijacking vulnerability in SAProuter on Microsoft Windows |
| CVE-2026-44752 | 8.2 HIGH | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java(Configur |
| CVE-2026-44745 | 8.1 HIGH | Open Redirect vulnerability in SAP Approuter |
| CVE-2026-58233 | 7.6 HIGH | Remote Code Execution vulnerability in SAP Change and Transport System Attach Tool (ctsatt |
| CVE-2026-44767 | 6.1 MEDIUM | Allowlist Bypass in setThemeRoot() Enables Cross-Origin CSS Injection |
| CVE-2026-44769 | 5.5 MEDIUM | SQL Injection vulnerability in SAP S/4HANA Project Management (PPM-PRO) |
| CVE-2026-44760 | 4.7 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applica |
| CVE-2026-44771 | 4.3 MEDIUM | Missing Authorization check in SAP S/4HANA (Draft operation) |
| CVE-2026-44770 | 4.3 MEDIUM | Missing Authorization check in SAP S/4 HANA (Create Single Payment) |
| CVE-2026-44768 | 4.1 MEDIUM | Security misconfiguration in SAP CRM (WebClient UI) |
| CVE-2026-44753 | 3.7 LOW | Information Disclosure vulnerability in SAP HANA Extended Application Services classic mod |
IV. Related Vulnerabilities
Same product: SAP NetWeaver Enterprise Portal
- CVE-2026-0499
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver En - CVE-2025-42872
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver En - CVE-2025-42884
JNDI Injection vulnerability in SAP NetWeaver Enterprise Por - CVE-2024-44120
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver En - CVE-2023-33985
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver En
Same vendor: SAP_SE
- CVE-2026-58231
Improper Authorization in SAP Commerce Cloud (Data Hub Adapt - CVE-2026-66779
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Ap - CVE-2026-66778
Multiple vulnerabilities in SAP Business AI Platform (Approu - CVE-2026-66777
Multiple vulnerabilities in SAP Business AI Platform (Approu - CVE-2026-66776
Multiple vulnerabilities in SAP Business AI Platform (Approu
Same weakness: CWE-79
- CVE-2026-49864
wetty vulnerable to DOM XSS via file-download filename - CVE-2026-73531
django-helpdesk < 2.3.3 Stored XSS via HTML Attachments - CVE-2026-73038
NodeBB < 4.15.0 Stored XSS via ActivityPub emoji tag.icon.ur - CVE-2026-73037
Next AI Draw.io 0.2.1 - 0.4.16 Reflected XSS via unsanitized - CVE-2026-73650
SVGO: removeScripts plugin leaves some executable scripts in
V. Comments for CVE-2026-44759
No comments yet