What is the CVSS score of CVE-2026-44746?

CVE-2026-44746 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

SAP NetWeaver JAVA CVE-2026-44746

EUVD-2026-35282 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-09 cna@sap.com

GHSA-r38j-ghgj-963g

XSS SAP Java

6.1

CVSS 3.1 · Vendor: sap

Severity by source

Vendor (sap) PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from Vendor (sap) · only source for this CVE.

CVSS VectorVendor: sap

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 09, 2026 - 01:34 vuln.today

DescriptionCVE.org

Due to a reflected cross-site scripting (XSS) vulnerability in SAP NetWeaver JAVA (JDBC Test Servlet), an unauthenticated attacker could craft a URL that embeds a malicious script. If a victim clicks this link, the injected input is processed during web page generation, resulting in the execution of malicious content in the victim's browser. This could allow the attacker to access and/or modify information related to the webclient, impacting the confidentiality and integrity of the application, with no impact to availability.

AnalysisAI

Reflected cross-site scripting in SAP NetWeaver JAVA's JDBC Test Servlet enables unauthenticated remote attackers to craft malicious URLs that execute arbitrary JavaScript in a victim's browser upon interaction. The Changed Scope (S:C) in the CVSS vector indicates the injected script can affect browser context beyond the vulnerable origin, enabling session theft, credential harvesting, or unauthorized modification of webclient data. No public exploit code has been identified at time of analysis, and this vulnerability has not been listed in the CISA KEV catalog.

Technical ContextAI

CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) describes the root cause: user-supplied input passed to the JDBC Test Servlet is reflected into the HTTP response without adequate sanitization or encoding, allowing injected HTML/JavaScript payloads to be interpreted by the victim's browser. The JDBC Test Servlet is a Java EE component within the SAP NetWeaver JAVA platform used for database connectivity testing. Because the CVSS vector specifies Changed Scope (S:C), the impact boundary extends beyond the vulnerable component - scripts can interact with browser storage, cookies, or other same-browser origins. No CPE strings were provided in the available data, so exact affected product versions cannot be enumerated from this source alone; the SAP Security Note 3723655 should be consulted for authoritative version scope.

RemediationAI

Apply the fix documented in SAP Security Note 3723655, available through the SAP Support Portal at https://me.sap.com/notes/3723655. This note was published as part of SAP Security Patch Day (https://url.sap/sapsecuritypatchday) and constitutes the vendor's primary remediation guidance. An exact patched version number is not confirmed in the available data - consult the SAP note directly for specific release information. As a compensating control pending patching, consider restricting network access to the JDBC Test Servlet endpoint at the web application firewall or reverse proxy layer, since this is a diagnostic servlet unlikely to be required for production end-user access. This restriction carries the trade-off of potentially disrupting database connectivity testing workflows for administrators. Additionally, implementing Content Security Policy (CSP) headers at the network perimeter could limit the impact of any reflected XSS execution even if the endpoint remains accessible.