CVE-2026-44759: CWE-79: Improper Neutralization of Input During Web Page Generation in SAP_SE SAP NetWeaver Enterprise Portal
CVE-2026-44759 is a cross-site scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal that allows unauthenticated attackers to inject malicious scripts via a URL parameter. These scripts are reflected in the server response and executed in users' browsers, potentially leading to session theft, content manipulation, or user redirection. The vulnerability impacts confidentiality and integrity with no effect on availability. The CVSS score is 6.1, indicating a medium severity level. No affected versions or patches are specified in the available data.
AI Analysis
Technical Summary
This vulnerability (CVE-2026-44759) in SAP NetWeaver Enterprise Portal involves improper neutralization of input during web page generation (CWE-79). An unauthenticated attacker can craft a URL containing malicious script code in a parameter, which the server reflects in its response. When a user visits this URL, the script executes in their browser context, potentially allowing theft of session information, manipulation of portal content, or redirection to malicious sites. The vulnerability affects confidentiality and integrity but does not impact availability. No official remediation or patch information is provided, and no affected versions are explicitly stated.
Potential Impact
Successful exploitation can lead to theft of user session information, unauthorized manipulation of portal content, or redirection of users to malicious sites. This results in a low impact on confidentiality and integrity of the application, with no impact on availability. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when clicking on untrusted URLs and consider implementing web application firewall (WAF) rules to detect and block reflected XSS attempts. Monitor SAP's official advisories for updates on patches or mitigations.
CVE-2026-44759: CWE-79: Improper Neutralization of Input During Web Page Generation in SAP_SE SAP NetWeaver Enterprise Portal
Description
CVE-2026-44759 is a cross-site scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal that allows unauthenticated attackers to inject malicious scripts via a URL parameter. These scripts are reflected in the server response and executed in users' browsers, potentially leading to session theft, content manipulation, or user redirection. The vulnerability impacts confidentiality and integrity with no effect on availability. The CVSS score is 6.1, indicating a medium severity level. No affected versions or patches are specified in the available data.
CVSS v3.1
Score 6.1medium
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability (CVE-2026-44759) in SAP NetWeaver Enterprise Portal involves improper neutralization of input during web page generation (CWE-79). An unauthenticated attacker can craft a URL containing malicious script code in a parameter, which the server reflects in its response. When a user visits this URL, the script executes in their browser context, potentially allowing theft of session information, manipulation of portal content, or redirection to malicious sites. The vulnerability affects confidentiality and integrity but does not impact availability. No official remediation or patch information is provided, and no affected versions are explicitly stated.
Potential Impact
Successful exploitation can lead to theft of user session information, unauthorized manipulation of portal content, or redirection of users to malicious sites. This results in a low impact on confidentiality and integrity of the application, with no impact on availability. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when clicking on untrusted URLs and consider implementing web application firewall (WAF) rules to detect and block reflected XSS attempts. Monitor SAP's official advisories for updates on patches or mitigations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- sap
- Date Reserved
- 2026-05-07T18:31:04.067Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a558ad868715ace4361837b
Added to database: 07/14/2026, 01:03:20 UTC
Last enriched: 07/14/2026, 01:19:07 UTC
Last updated: 07/14/2026, 03:38:32 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.