This vulnerability (CVE-2026-44759) in SAP NetWeaver Enterprise Portal involves improper neutralization of input during web page generation (CWE-79). An unauthenticated attacker can craft a URL containing malicious script code in a parameter, which the server reflects in its response. When a user visits this URL, the script executes in their browser context, potentially allowing theft of session information, manipulation of portal content, or redirection to malicious sites. The vulnerability affects confidentiality and integrity but does not impact availability. No official remediation or patch information is provided, and no affected versions are explicitly stated.

Successful exploitation can lead to theft of user session information, unauthorized manipulation of portal content, or redirection of users to malicious sites. This results in a low impact on confidentiality and integrity of the application, with no impact on availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when clicking on untrusted URLs and consider implementing web application firewall (WAF) rules to detect and block reflected XSS attempts. Monitor SAP's official advisories for updates on patches or mitigations.