CVE-2026-89117
6.1MediumPublished 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- Limited impact
- Weakness
- CWE-79
Impact
Attackers can hijack user sessions, steal credentials, and manipulate portal content by getting a victim to click a crafted link. This requires network access to the portal and user interaction, but no initial authentication.
Root cause
Improper input sanitization reflects unsanitized URL parameters directly back into the browser response, enabling reflected cross-site scripting (XSS).
Affected systems
SAP NetWeaver Enterprise Portal (exact versions not listed in the advisory summary — check SAP Note 3779985).
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Fix & remediation
Apply the security patch referenced in SAP Security Note 3779985 from the SAP Support Portal. If patching must wait, block or filter malicious script payloads in URL parameters at your reverse proxy or web application firewall (WAF).
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal content, or user redirection. This results in a low impact on confidentiality and integrity. There is no impact on availability.