CVE-2026-66779 Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP
An authenticated attacker can execute malicious scripts in a victim's browser via a crafted link, compromising confidentiality and integrity.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-66779?
CVE-2026-66779 is a medium-severity cross-site scripting vulnerability in SAP_SE SAP NetWeaver Application Server ABAP, published on 11 Aug 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP, an authenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated victim accesses this link, the injected input is processed and reflected within the DOM on the client side during page rendering, resulting in the execution of malicious content in the victim's browser context. Successful exploitation could result in a high impact to the confidentiality and a low impact to the integrity of the system, while availability remains unaffected.
Weakness: CWE-79
Which versions are affected by CVE-2026-66779?
How do I fix CVE-2026-66779?
No fix has been published for CVE-2026-66779 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-66779 being exploited?
There is no known exploitation of CVE-2026-66779 in the wild and no public exploit code.
Sources
Also known as GHSA-7p2q-g3fc-cm89.