JavaScript Injection Vulnerability in SAP NetWeaver Application Server
CVE-2026-44752

8.2HIGH

Key Information:

Vendor

SAP
Status
SAP Netweaver Application Server Java(configuration Wizard)
Vendor
CVE Published:
14 July 2026

What is CVE-2026-44752?

The SAP NetWeaver Application Server Java has a vulnerability that permits an unauthenticated attacker to inject harmful JavaScript via specially crafted URLs. When a user unknowingly navigates to such a URL, the malicious script executes in their browser context. This allows the attacker to access sensitive session information and potentially alter non-sensitive data that is presented in the victim's browser. The impact mainly concerns the confidentiality of the user's sensitive information while also posing risks to user experience.

Affected Version(s)

SAP NetWeaver Application Server Java(Configuration Wizard) LMCTC 7.50

References

https://me.sap.com/notes/3748227
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
8.2
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.