CVE-2026-27682

Vulnerability

Overview

CVE-2026-27682 is a reflected cross-site scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP, specifically in applications based on Business Server Pages (BSP). The root cause is an unprotected URL parameter that is not properly sanitized during web page generation, allowing an attacker to inject arbitrary script code into the response [1].

Exploitation

An unauthenticated attacker can exploit this vulnerability by crafting a malicious URL containing the injected script. The victim must click on the crafted link, which causes the injected input to be processed and reflected back in the browser context. No authentication or special network position is required; the attack is performed remotely via social engineering [1].

Impact

Successful exploitation enables the attacker to execute arbitrary script in the victim's browser, potentially accessing or modifying sensitive information within the application's context. This impacts the confidentiality and integrity of the affected SAP system, with no effect on availability [1].

Mitigation

SAP has addressed this vulnerability through its regular Security Patch Day process. Customers are advised to apply the relevant SAP Security Notes as provided in the vendor advisory [1]. Organizations should prioritize patching to mitigate the risk of XSS attacks.