Insufficient Parameter Validation in SAP NetWeaver Application Server Java
CVE-2026-109810

6.1MEDIUM

Key Information:

Vendor

SAP
Status
SAP Netweaver Application Server Java (web Dynpro Java)
Vendor
CVE Published:
10 November 2026

What is CVE-2026-109810?

The SAP NetWeaver Application Server Java (Web Dynpro Java) has a vulnerability resulting from inadequate validation of request parameters for styling resources. This issue allows an unauthenticated attacker to craft a malicious link that, when accessed by an authenticated user, can lead to the browser loading unauthorized styling content in the context of the trusted application. This attack can facilitate user interface manipulation for phishing attempts and may enable limited content exfiltration, impacting confidentiality and integrity without affecting system availability.

Affected Version(s)

SAP NetWeaver Application Server Java (Web Dynpro Java) WD-RUNTIME 7.50

References

https://me.sap.com/notes/3797108
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.