cbcvebase.
CVE-2026-44760
published 2026-07-14

CVE-2026-44760: Due to a Cross-Site Scripting (XSS) vulnerability, applications based on Business Server Pages framework in SAP NetWeaver Application Server ABAP reflects…

PriorityP423medium4.7CVSS 3.1
AVNACHPRNUIRSCCLILAN
EPSS
0.14%
3.9th percentile
Due to a Cross-Site Scripting (XSS) vulnerability, applications based on Business Server Pages framework in SAP NetWeaver Application Server ABAP reflects unsanitized input into the HTTP response which allows an attacker to inject and execute arbitrary JavaScript code under certain conditions. Successful exploitation could allow the attacker to steal session information, perform authenticated actions on behalf of the victim user etc. This vulnerability has low impact on confidentiality and integrity of the data and no impact on application 's availability.

Affected

18 ranges
VendorProductVersion rangeFixed in
sap_sesap_netweaver_application_server_abap——
sap_sesap_netweaver_application_server_abap——
sap_sesap_netweaver_application_server_abap——
sap_sesap_netweaver_application_server_abap——
sap_sesap_netweaver_application_server_abap——
sap_sesap_netweaver_application_server_abap——
sap_sesap_netweaver_application_server_abap——
sap_sesap_netweaver_application_server_abap——
sap_sesap_netweaver_application_server_abap——
sap_sesap_netweaver_application_server_abap——
sap_sesap_netweaver_application_server_abap——
sap_sesap_netweaver_application_server_abap——
sap_sesap_netweaver_application_server_abap——
sap_sesap_netweaver_application_server_abap——
sap_sesap_netweaver_application_server_abap——
sap_sesap_netweaver_application_server_abap——
sap_sesap_netweaver_application_server_abap——
sap_sesap_netweaver_application_server_abap——
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.