CVE-2026-76976
published 2026-10-13CVE-2026-76976: Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain functionality…
PriorityP430medium5.4CVSS 3.1
AVNACLPRLUIRSCCLILAN
EPSS
0.14%
2.9th percentile
Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain functionality, allowing an authenticated attacker to send malicious content to another user. If the victim interacts with the affected content, malicious scripts could be executed in the victim's browser context. This vulnerability has a low impact on the confidentiality and integrity of the data and no impact on the availability of the application.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| sap_se | sap_netweaver_application_server_abap | — | — |
| sap_se | sap_netweaver_application_server_abap | — | — |
| sap_se | sap_netweaver_application_server_abap | — | — |
| sap_se | sap_netweaver_application_server_abap | — | — |
| sap_se | sap_netweaver_application_server_abap | — | — |
| sap_se | sap_netweaver_application_server_abap | — | — |
| sap_se | sap_netweaver_application_server_abap | — | — |
| sap_se | sap_netweaver_application_server_abap | — | — |
| sap_se | sap_netweaver_application_server_abap | — | — |
| sap_se | sap_netweaver_application_server_abap | — | — |
| sap_se | sap_netweaver_application_server_abap | — | — |
| sap_se | sap_netweaver_application_server_abap | — | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
SAP NetWeaver Application Server ABAP SAP_BASIS 731 up to SAP_BASIS 758 cross site scripting
vuldb·2026-10-13·CVSS 5.4
CVE-2026-76976 [MEDIUM] SAP NetWeaver Application Server ABAP SAP_BASIS 731 up to SAP_BASIS 758 cross site scripting
A vulnerability identified as problematic has been detected in SAP NetWeaver Application Server ABAP. This affects an unknown part. The manipulation leads to cross site scripting.
This vulnerability is traded as CVE-2026-76976. It is possible to initiate the attack remotely. There is no exploit available.
GHSA
Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain functionality, allowing an authenticated attacker to send
ghsa_unreviewed·2026-10-13
CVE-2026-76976 [MEDIUM] CWE-79 Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain functionality, allowing an authenticated attacker to send
Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain functionality, allowing an authenticated attacker to send malicious content to another user. If the victim interacts with the affected content, malicious scripts could be executed in the victim's browser context. This vulnerability has a low impact on the confidentiality and integrity of the data and no impact on the availability of the application.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-10-13
Published