This vulnerability (CVE-2026-44746) is a reflected XSS issue in SAP NetWeaver AS Java Component UDI (BI_UDI 7.50). It arises from improper neutralization of input during web page generation in the JDBC Test Servlet, allowing an attacker to inject malicious scripts via crafted URLs. When a victim clicks such a URL, the malicious script executes in their browser context, potentially compromising confidentiality and integrity of the web client session. The CVSS 3.1 base score is 6.1 (medium severity), with attack vector network, low attack complexity, no privileges required, user interaction required, scope changed, and impacts to confidentiality and integrity but not availability. No known exploits in the wild or vendor patches have been reported as of the published date.

Successful exploitation allows an unauthenticated attacker to execute arbitrary scripts in the context of the victim's browser session with the SAP NetWeaver AS Java Component UDI web client. This can lead to unauthorized access or modification of information related to the web client, affecting confidentiality and integrity. Availability is not impacted. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or remediation level is provided, users should monitor SAP's security advisories for updates. Until a fix is available, avoid clicking suspicious URLs related to the affected component and consider restricting access to the JDBC Test Servlet if possible.