What is the CVSS score of CVE-2026-44752?

CVE-2026-44752 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of SAP NetWeaver AS Java are affected by CVE-2026-44752?

SAP NetWeaver Application Server Java contains a reflected cross-site scripting vulnerability (CVE-2026-44752) that enables phishing-based attacks to compromise user sessions and expose sensitive…

How to fix or mitigate CVE-2026-44752?

Within 24 hours, inventory all SAP NetWeaver Application Server Java instances with internet connectivity and confirm whether the Configuration Wizard is accessible externally using vulnerability scans and network asset management tools. Within seven days, restrict network access to the Configuration Wizard to administrative subnets only through firewall rules or security groups, deploy web application firewall (WAF) rules to detect and block reflected XSS payloads in URL parameters, and distribute targeted security awareness training to SAP administrators and users warning of phishing attacks exploiting this vulnerability. Within 30 days, implement monitoring and alerting on Configuration Wizard access logs for anomalous user behavior and suspicious login patterns, evaluate whether internet exposure of SAP administrative tools is architecturally necessary for business operations, and establish a process to rapidly deploy patches once SAP releases CVE-2026-44752 remediation.

SAP NetWeaver AS Java CVE-2026-44752

EUVD-2026-43587 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-07-14 sap

GHSA-q9j6-4pfx-9vfj

SAP XSS Information Disclosure Java Sap Netweaver Application Server Java Configuration Wizard

8.2

CVSS 3.1 · Vendor: sap

Severity by source

Vendor (sap) PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

vuln.today AI

8.2 HIGH

Network-reachable reflected XSS needing no auth (PR:N) but victim click (UI:R); script escapes into victim session (S:C) exposing session data (C:H) with limited integrity (I:L).

3.1 AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (sap).

CVSS VectorVendor: sap

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 01:17 vuln.today

CVE Published

Jul 14, 2026 - 00:19 cve.org

HIGH 8.2

DescriptionCVE.org

SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafted URLs. When a victim accesses such a URL, the script executes in the user's browser, allowing the attacker to access sensitive session information and modify non-sensitive data displayed in the client�s browser. This results in a high impact on confidentiality, low impact on integrity with no impact on availability of the application.

AnalysisAI

Reflected cross-site scripting in SAP NetWeaver Application Server Java (specifically the Configuration Wizard component) lets an unauthenticated attacker embed malicious JavaScript in crafted URLs that executes in a victim's browser when the link is opened. Because the CVSS scope is changed (S:C) and confidentiality impact is high, a successful lure can expose sensitive session information and tamper with non-sensitive data rendered in the client. No public exploit identified at time of analysis, but the 8.2 CVSS and unauthenticated, network-reachable vector make it a meaningful phishing-driven risk for exposed SAP portals.

Technical ContextAI

The flaw is a classic CWE-79 (Improper Neutralization of Input During Web Page Generation) reflected XSS in the Java stack of SAP NetWeaver Application Server, a widely deployed enterprise application platform that hosts SAP portal, administration, and configuration services. The affected surface per the CPE (cpe:2.3:a:sap_se:sap_netweaver_application_server_java(configuration_wizard)) is the Configuration Wizard, a browser-based administrative setup tool. User-supplied parameters in a URL are reflected into the HTTP response without adequate output encoding, so the browser interprets attacker-controlled content as executable script in the security context of the SAP application origin. The CVSS scope change (S:C) reflects that the injected script executes in the victim's authenticated browser session, crossing the trust boundary from the vulnerable component to the user's authenticated context and its data.

RemediationAI

Apply the fix from SAP Security Note 3748227 (https://me.sap.com/notes/3748227), released as part of SAP Security Patch Day (https://url.sap/sapsecuritypatchday); the input does not specify an exact patched version, so confirm the precise SP/patch level directly in the SAP Note before deployment. Because this is the Configuration Wizard, a strong compensating control is to restrict or disable access to the Configuration Wizard endpoints in production - the wizard is a setup tool and is typically not needed during normal operation, so blocking it at the reverse proxy/Web Dispatcher or removing it from internet exposure has minimal operational side effects. Additional interim mitigations: place NetWeaver AS Java behind SAP Web Dispatcher or a WAF with rules to filter script-bearing URL parameters, restrict administrative interfaces to trusted management networks, and enforce browser-side protections (Content-Security-Policy, HttpOnly/Secure session cookies to limit session-token theft), noting that CSP and WAF filtering can break legitimate admin functionality and require testing before enforcement.