CVE-2026-76976

5.4Medium

Published 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

5.4Medium

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: Required
Impact: Limited impact
Weakness: CWE-79

Impact

Authenticated attackers can run malicious scripts in another user's browser session. To succeed, the attacker must send crafted content to the victim and get them to interact with it.

Root cause

SAP GUI for HTML fails to sufficiently sanitize user-supplied input before rendering it in the application.

Affected systems

Versions not listed — check the vendor advisory.

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Fix & remediation

Apply the security patch referenced in SAP Note 3671819; no interim mitigation or workaround is provided.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain functionality, allowing an authenticated attacker to send malicious content to another user. If the victim interacts with the affected content, malicious scripts could be executed in the victim's browser context. This vulnerability has a low impact on the confidentiality and integrity of the data and no impact on the availability of the application.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-76976