CVE-2026-89117: CWE-79: Improper Neutralization of Input During Web Page Generation in SAP_SE SAP NetWeaver Enterprise Portal

This vulnerability (CWE-79) in SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The injected scripts are reflected in the server's response and executed in the context of the user's browser when the crafted URL is accessed. This can result in theft of session tokens, unauthorized manipulation of portal content, or redirecting users to malicious sites. The CVSS v3.1 base score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and partial confidentiality and integrity impact but no availability impact. No patch or remediation details are provided in the source data.

The vulnerability allows attackers to execute arbitrary scripts in users' browsers, potentially leading to theft of session information, unauthorized content manipulation, or user redirection. The confidentiality and integrity impacts are low, and availability is not affected.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should exercise caution when clicking on untrusted links. No official fix or workaround information is provided in the available data.