SAP Wily Introscope CVE-2026-44757

Exploitation requires the victim to actively navigate to an attacker-crafted URL (UI:R is mandatory - passive network position is insufficient). The phrase 'under certain conditions' in the description, combined with AC:H, indicates that the XSS does not trigger universally across all URL inputs - specific parameters, endpoints, or application states must be targeted, and the attacker must correctly identify these conditions. The attacker requires no credentials (PR:N confirmed by CVSS). Exploitation is limited by: (1) required victim interaction with a malicious link, (2) high attack complexity implying non-trivial payload construction or condition matching, (3) low impact ceiling limiting post-exploitation value, and (4) the likely deployment pattern of Introscope on internal enterprise networks rather than public internet, restricting the reachable victim pool.

The CVSS 4.7 Medium score reflects a genuine ceiling on impact: C:L and I:L constrain post-exploitation value to session data theft or limited UI manipulation, with no availability impact. The AC:H designation signals that exploitation is not straightforward - specific conditions must align, likely involving particular URL parameters or application states, meaning mass or automated exploitation is unlikely. The UI:R requirement introduces a reliable social-engineering dependency, further reducing weaponization potential. No EPSS score was provided, preventing probabilistic exploitation comparison. Critically, this CVE carries no CISA KEV listing and no identified public POC, meaning exploitation remains theoretical at time of analysis. For organizations exposing Introscope Enterprise Manager on internal networks to privileged APM users (administrators, developers), the realistic threat is a targeted phishing campaign rather than opportunistic scanning. For internet-exposed deployments, the risk rises modestly due to the larger victim pool.

An attacker identifies an authenticated SAP Wily Introscope user (typically a developer or APM administrator) and sends a phishing message containing a crafted Introscope URL with an embedded XSS payload in a vulnerable parameter. When the victim clicks the link and their browser renders the application response, the malicious script executes in the Introscope application context, potentially harvesting the victim's session token or performing actions within the APM console on their behalf. No public POC is known, so the attacker would need to independently identify the injectable parameter and craft a working payload, consistent with the AC:H rating.