CVE-2026-76976: CWE-79: Improper Neutralization of Input During Web Page Generation in SAP_SE SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)

This vulnerability in SAP NetWeaver Application Server ABAP (SAP GUI for HTML applications) is due to improper neutralization of input during web page generation (CWE-79). Authenticated attackers can inject malicious content that, when interacted with by other users, executes scripts in their browser context. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, and user interaction. There is no indication of active exploitation or an official patch provided in the input data.

An authenticated attacker can cause execution of malicious scripts in the browser of another user, potentially leading to limited confidentiality and integrity impacts. There is no impact on application availability. The vulnerability could allow unauthorized actions or data disclosure within the scope of the victim user's session.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided in the available data. Until a patch is available, consider restricting user privileges and educating users about interacting with untrusted content within SAP GUI for HTML applications.