CVE-2026-44768: SAP CRM WebClient UI allows an attacker to inject and execute malicious scripts in the context of the application due to the absence of a Content Security…

PriorityP421medium4.1CVSS 3.1

AVNACLPRLUIRSCCNILAN

EPSS

0.17%

6.0th percentile

SAP CRM WebClient UI allows an attacker to inject and execute malicious scripts in the context of the application due to the absence of a Content Security Policy (CSP) configuration for certain restrictive directives. This vulnerability has a low impact on the integrity of the application. Confidentiality and availability are not impacted.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
sap_se	sap_crm	—	—
sap_se	sap_crm	—	—
sap_se	sap_crm	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.