SAP NetWeaver Application Server ABAP CVE-2026-27682

Exploitation requires the following specific conditions: the vulnerable URL parameter must not be protected by input validation or output encoding in the Business Server Pages application code; the victim must click or be redirected to the crafted URL (no automatic exploitation); the victim's browser must have JavaScript enabled; and the SAP NetWeaver instance must be configured to process and render the malicious parameter value in the HTTP response. Exploitation is limited by the reflected nature (each attack requires a new victim to click a unique link), the requirement for user interaction (UI:R), and the high attack complexity (AC:H), which may indicate dependency on specific browser behavior, parameter handling quirks, or non-standard configurations. Modern browsers with XSS protections may mitigate some variants.

CVSS score of 4.7 (Medium) with network attack vector (AV:N) reflects the unauthenticated, remote nature of exploitation, but the high complexity (AC:H) and required user interaction (UI:R) significantly constrain real-world attack feasibility. EPSS and KEV status data are not provided, limiting assessment of active exploitation likelihood. The vulnerability impacts only confidentiality (C:L) and integrity (I:L) with no availability impact (A:N), and scope is changed (S:C), meaning impact crosses privilege boundaries but is limited in scope. The reflected nature of XSS typically results in lower real-world priority than stored variants, as each attack requires a fresh victim link. Risk is moderate for organizations with significant SAP NetWeaver deployments where users may be socially engineered to click suspicious links, but exploitation requires both crafted URL delivery and victim click-through, reducing practical threat level compared to automated attacks.

An attacker crafts a malicious URL embedding JavaScript in an unprotected URL parameter (e.g., 'https://vulnerable-sap-server/bsp/page?param=<script>alert(1)</script>') and sends it via email or social engineering to a SAP application user. When the victim clicks the link, the SAP server reflects the injected script in the HTML response without sanitization, causing the browser to execute the attacker's JavaScript in the victim's session context. The attacker can then steal session cookies, redirect to a phishing page, or modify displayed content.