Input Validation Flaw in SAP NetWeaver Visual Composer

CVE-2026-120016

What is CVE-2026-120016?

SAP NetWeaver Visual Composer has been identified with an input validation flaw that allows unauthenticated attackers to craft malicious links with specially formed input. If a target user clicks on such a link, the malicious script executes in their browser, leveraging the context of the affected application. This vulnerability exposes sensitive user data and can compromise data confidentiality and integrity within the impacted environment. Users are advised to review their security postures and apply relevant patches as necessary.

References