CVE-2026-76976— Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)
Quick assessment
Affected
SAP_SE SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
基于 SAP NetWeaver 应用服务器 ABAP 平台的 SAP GUI for HTML 应用程序在特定功能中未对用户提供的数据进行充分清理，导致经过身份验证的攻击者可以向其他用户发送恶意内容。如果受害者与受影响的內容进行交互，恶意脚本将在受害者浏览器的上下文中被执行。此漏洞对数据的保密性和完整性影响较低，对应用程序的可用性没有影响。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1189 · Drive-by CompromiseAffected Version Matrix 12
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| SAP_SE | SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML) | SAP_BASIS 731 |
affected |
SAP_BASIS 740 |
affected | ||
SAP_BASIS 750 |
affected | ||
SAP_BASIS 751 |
affected | ||
SAP_BASIS 752 |
affected | ||
SAP_BASIS 753 |
affected | ||
SAP_BASIS 754 |
affected | ||
SAP_BASIS 755 |
affected | ||
| … +4 more rows | |||
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-76976
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)
Source: CVE Program / CVE List V5
Vulnerability Description
Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain functionality, allowing an authenticated attacker to send malicious content to another user. If the victim interacts with the affected content, malicious scripts could be executed in the victim's browser context. This vulnerability has a low impact on the confidentiality and integrity of the data and no impact on the availability of the application.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| SAP_SE | SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML) | SAP_BASIS 731 | - |
|
II. Public POCs for CVE-2026-76976
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-76976
请登录查看更多情报信息。
Other References for CVE-2026-76976 (1)
Same Patch Batch · SAP_SE · 2026-10-13 · 20 CVEs total
| CVE-2026-89111 | 10.0 CRITICAL | OAuth2 SSRF vulnerability in SAP Cloud SDK for Python |
| CVE-2026-89107 | 9.9 CRITICAL | Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules) |
| CVE-2026-89110 | 9.9 CRITICAL | Broken Access Control in SAP NetWeaver Visual Composer |
| CVE-2026-89108 | 9.1 CRITICAL | Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configurati |
| CVE-2026-89113 | 8.8 HIGH | SQL Injection vulnerability in SAP Commerce Cloud (OOTB Code) |
| CVE-2026-58249 | 7.5 HIGH | Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communic |
| CVE-2026-89120 | 7.1 HIGH | Missing authorization check in SAP ABAP Platform |
| CVE-2026-76972 | 6.5 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence |
| CVE-2026-89112 | 6.5 MEDIUM | Broken Access Control in CLA-Assistant � CLA Signature PII Disclosure |
| CVE-2026-89122 | 6.1 MEDIUM | Open Redirect Vulnerability in SAP NetWeaver Enterprise Portal |
| CVE-2026-89117 | 6.1 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal |
| CVE-2026-76975 | 6.1 MEDIUM | Cross-Site Scripting (XSS) vulnerability in SAPUI5 (Support Assistant Overlay) |
| CVE-2026-89116 | 5.9 MEDIUM | OS Command Injection in Yeoman-UI / Application Wizard Extension for VS Code |
| CVE-2026-89118 | 5.3 MEDIUM | Information Disclosure vulnerability in SAP NetWeaver Enterprise Portal |
| CVE-2026-89121 | 4.7 MEDIUM | Missing Authorization Check in SAP S/4HANA (Linear Asset Management RAP Business Object) |
| CVE-2026-89106 | 4.4 MEDIUM | Cross Site Scripting (XSS) vulnerability in SAPUI5 |
| CVE-2026-89124 | 4.3 MEDIUM | Missing Authorization Check in SAP Global Trade Services, edition for SAP HANA (Display Pr |
| CVE-2026-89105 | 4.2 MEDIUM | Improper Authentication in HybridTokenAuthenticator of SAP/cloud-security-services-integra |
| CVE-2026-58242 | 3.5 LOW | Improper Authorization check in SAP Cloud Connector |
IV. Related Vulnerabilities
Same vendor: SAP_SE
-
CVE-2026-89124
Missing Authorization Check in SAP Global Trade Services, ed -
CVE-2026-89122
Open Redirect Vulnerability in SAP NetWeaver Enterprise Port -
CVE-2026-89121
Missing Authorization Check in SAP S/4HANA (Linear Asset Man -
CVE-2026-89120
Missing authorization check in SAP ABAP Platform -
CVE-2026-89118
Information Disclosure vulnerability in SAP NetWeaver Enterp
Same weakness: CWE-79
-
CVE-2026-103899
EU VAT Assistant for WooCommerce <= 2.1.30.260413 - Unauthen -
CVE-2026-109989
Themify Popup <= 1.4.7 - Authenticated (Author+) Stored Cros -
CVE-2026-111726
Themify Builder <= 7.8.2 - Authenticated (Contributor+) Stor -
CVE-2026-96660
User Registration & Membership <= 5.2.8 - Unauthenticated St -
CVE-2026-109985
xSpeed Cache: AI-Powered Performance Hub with MCP, Caching &
V. Comments for CVE-2026-76976
No comments yet