This vulnerability (CVE-2026-0512) is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting (XSS). It exists in the SICF Handler component of the SAP Supplier Relationship Management (SRM) Catalog. The flaw allows an unauthenticated attacker to craft a malicious URL that executes arbitrary scripts in the context of a victim's browser session, potentially leading to unauthorized access and modification of sensitive information. The vulnerability has a CVSS 3.1 base score of 6.1, indicating medium severity, with network attack vector, low attack complexity, no privileges required, user interaction required, and impacts on confidentiality and integrity but not availability. The affected versions include SRM_SERVER 702, 713, and 714. No vendor advisory or patch information is currently available.

Successful exploitation could allow an attacker to execute malicious scripts in the victim's browser, leading to unauthorized access and modification of information within the SAP SRM application. This compromises the confidentiality and integrity of data but does not affect system availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should consider applying web application firewall (WAF) rules to detect and block malicious input targeting the vulnerable SICF Handler. Additionally, user awareness to avoid clicking suspicious URLs can reduce risk. Monitor SAP's official channels for updates and patches.