This vulnerability (CVE-2026-27674) in SAP NetWeaver Application Server Java (Web Dynpro Java) WD-RUNTIME 7.50 involves improper control of code generation (CWE-94). Specifically, it allows an unauthenticated attacker to inject code by supplying crafted input that the application interprets, leading to execution of attacker-controlled content in the victim's browser. This can result in session compromise and arbitrary client-side code execution, affecting confidentiality and integrity. The CVSS 3.1 base score is 6.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low impact on confidentiality and integrity with no impact on availability. There is no vendor advisory or patch information available at this time.

An attacker can execute arbitrary client-side code in the context of a victim's browser session by injecting crafted input into the vulnerable SAP NetWeaver Application Server Java component. This can lead to session compromise and unauthorized access to confidential information or manipulation of data integrity. Availability is not affected. The vulnerability requires user interaction (victim must access the affected functionality) and can be exploited remotely without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, organizations should consider restricting access to the affected functionality, applying input validation or sanitization where possible, and educating users about the risks of interacting with untrusted content. Monitor SAP's official channels for updates and patches.