Unauthenticated Script Injection Vulnerability in SAP NetWeaver Enterprise Portal

CVE-2026-89117

What is CVE-2026-89117?

The SAP NetWeaver Enterprise Portal has a vulnerability that allows an attacker to inject malicious scripts through a URL parameter without authentication. When a user accesses the specially crafted URL, the server reflects the injected scripts in the response, leading to execution in the user's browser. This can result in unauthorized access to session information, alteration of portal content, or redirection of users to malicious sites. While this vulnerability poses risks related to the confidentiality and integrity of user data, it does not affect the overall availability of the portal. Organizations using this product should prioritize applying the necessary security patches to mitigate the potential impact.

References