SAP NetWeaver AS ABAP CVE-2026-44760

Exploitation requires that the target SAP system exposes one or more BSP framework application endpoints over a network-reachable interface (consistent with AV:N), and that the specific BSP page and parameter being requested reflects user input unsanitized into the response - not all BSP pages or parameters are necessarily vulnerable, which aligns with the AC:H rating. A victim user must actively interact with the attacker-supplied URL (UI:R), meaning passive exploitation without user action is not possible. The attacker requires no prior authentication or system privileges (PR:N). Limiting factors: mandatory victim click interaction; high attack complexity requiring the attacker to identify the specific vulnerable BSP parameter; impact confined to the browser context with no server-side code execution or availability impact; and the scope limited to the victim user's session data and the actions they are authorized to perform. Organizations that gate BSP application access behind VPN or internal-only network segments significantly reduce exposure, as the AV:N vector only applies when the endpoint is externally reachable.

The CVSS 4.7 Medium score with vector AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N presents a nuanced risk picture. The network attack vector and absence of required attacker privileges (PR:N) increase exposure for internet-facing BSP deployments, but the mandatory victim user interaction (UI:R) and high attack complexity (AC:H) are meaningful barriers: exploitation is not fire-and-forget and requires luring a specific authenticated user to a precisely crafted URL while specific page/parameter conditions align. No EPSS data was provided in the intelligence feed, so probabilistic exploitation likelihood cannot be quantified. Neither a public proof-of-concept nor a CISA KEV entry was identified, suggesting no confirmed mass or targeted active exploitation at time of analysis. Despite the moderate CVSS, SAP NetWeaver AS ABAP systems are high-value enterprise targets processing sensitive ERP data (finance, HR, procurement); even a low-integrity XSS can cascade to significant business data exposure or fraudulent transactions if exploited against a privileged SAP user. The AC:H rating is consistent with reflected XSS where only specific BSP pages and parameters are vulnerable rather than the entire surface. No conflict between CVSS signal and the description is observed.

An attacker identifies a BSP application endpoint on an internet-facing SAP NetWeaver system where a URL query parameter is reflected unsanitized into the response HTML. The attacker crafts a URL embedding a JavaScript payload (e.g., a cookie-stealing script) and delivers it to a logged-in SAP business user via a phishing email or poisoned internal hyperlink. When the victim clicks the link, their browser receives and executes the injected script, exfiltrating the SAP session token to an attacker-controlled server and enabling the attacker to replay that session to perform authenticated ERP transactions. No public PoC is identified at time of analysis, but reflected XSS exploitation is a well-documented, widely understood technique.