NetWeaver Enterprise Portal CVE-2026-44759

The CVSS vector PR:N/AC:L confirms the vulnerable URL parameter is accessible without authentication and requires no special portal configuration or feature enablement - any default deployment of SAP NetWeaver Enterprise Portal exposing the portal to network-reachable clients is affected. Exploitation is bounded by UI:R: the victim must have an active authenticated session with the portal AND must click or be redirected to the attacker-crafted URL - autonomous server-side exploitation is not possible. The impact is further limited to the victim's browser session scope on the portal origin; no server-side code execution or persistence is achievable through this vulnerability class. Internet exposure of the portal significantly increases practical exploitability, while VPN or intranet-only access substantially reduces the realistic attacker population.

The CVSS 6.1 Medium score (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) reflects a meaningful but bounded risk profile. The unauthenticated network vector with low attack complexity (PR:N/AC:L) confirms the portal endpoint is reachable without credentials and requires no special configuration to exploit, which meaningfully widens the attack surface in any Internet-exposed SAP deployment. The UI:R constraint - a victim must actively visit the crafted URL - is the primary limiting factor, requiring a social engineering vector such as phishing. Impact is explicitly capped at low confidentiality and low integrity with no availability component, consistent with reflected XSS that cannot persist payloads. No EPSS data was provided and no KEV listing exists, indicating this vulnerability is not known to be under active mass exploitation at time of analysis. The realistic threat is targeted: an attacker with knowledge of the organization's SAP portal URL and access to internal email channels could craft a convincing phishing lure to compromise a privileged portal user's session. For organizations with Internet-facing SAP portals, the priority is moderate; for internal-only deployments protected by network controls, practical exploitability is further constrained.

An attacker identifies an organization's Internet-facing SAP NetWeaver Enterprise Portal and crafts a URL embedding a JavaScript payload in the vulnerable parameter - for example, a script to exfiltrate document.cookie to an attacker-controlled host. The attacker sends this link via phishing email to a portal administrator or finance user with elevated SAP roles, spoofing a legitimate SAP notification. Upon clicking the link, the victim's browser renders the portal response containing the injected script, which silently transmits the session token to the attacker, who then replays it to access the portal under the victim's identity.