This vulnerability (CVE-2026-0512) involves improper neutralization of input during web page generation (CWE-79) in the SICF Handler component of SAP Supplier Relationship Management (SRM Catalog). It allows an unauthenticated attacker to perform Cross-Site Scripting (XSS) by crafting a malicious URL that executes arbitrary script code in the context of a victim's browser session. The affected SAP SRM versions are 702, 713, and 714. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity, with no impact on availability. The vendor has not yet provided an official fix or remediation level, and no exploits are known in the wild.

Successful exploitation allows an attacker to execute arbitrary script code in the victim's browser, potentially leading to unauthorized access and modification of information within the affected SAP SRM application. This impacts the confidentiality and integrity of the application data. Availability is not affected. The vulnerability requires user interaction (the victim must access the malicious URL) and does not require any privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider mitigating risks by restricting access to affected SAP SRM versions, educating users about phishing risks, and monitoring for suspicious URL activity. Do not rely on generic mitigations; follow vendor updates closely.