CVE-2026-76975
6.1MediumPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79
Impact
An attacker can execute arbitrary JavaScript in an authenticated user's browser session if the user clicks a malicious link. This allows the attacker to steal session data and tamper with application content.
Root cause
Client-side code reads untrusted input and writes it directly to the DOM without proper sanitization, enabling DOM-based cross-site scripting.
Affected systems
Versions not listed — check the vendor advisory.
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Fix & remediation
Apply the remediation documented in SAP Security Note 3794572; no interim workarounds are provided in the advisory.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
Due to a DOM-Based Cross-Site Scripting (XSS) vulnerability, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated user accesses this link, client-side code reads the attacker-controlled input and writes it into the DOM without proper sanitization, causing attacker-supplied script to execute in the victim�s browser context. This could allow the attacker to access or modify information within the victim�s browser scope, impacting confidentiality and integrity, while availability remains unaffected.