SAP CRM WebClient CVE-2026-44768

Exploitation requires the attacker to hold a valid low-privileged SAP CRM account, as confirmed by CVSS PR:L - unauthenticated exploitation is not possible. A victim user must actively interact with the attacker-controlled content within the WebClient UI, as confirmed by CVSS UI:R; passive drive-by exploitation is not applicable. The vulnerability is specifically contingent on the absence of Content Security Policy restrictive directives in SAP CRM WebClient UI responses - if CSP headers are already enforced externally (e.g., via WAF or reverse proxy), the injection vector is neutralized regardless of the application-level gap. Exploitation is further limited by: only low integrity impact with no confidentiality or availability consequence per the CVSS vector, and scope change is confined to the victim's browser session rather than the SAP application server.

The CVSS base score of 4.1 (Medium) accurately reflects the constrained impact profile: while the attack is network-reachable and low-complexity (AV:N/AC:L), it requires an authenticated low-privileged account (PR:L) and mandatory victim interaction (UI:R), introducing two meaningful friction points. Scope:Changed elevates concern slightly but impact is strictly bounded to low integrity with no confidentiality or availability consequence - limiting the blast radius relative to a full XSS account takeover. No EPSS score was provided in the input data; no CISA KEV listing exists; no POC has been identified. The absence of these amplifying signals positions this firmly as a low-urgency finding. The missing CSP headers represent a defense-in-depth failure rather than a direct server-side code execution path, which is consistent with the low impact ratings. The CWE-15 classification is inconsistent with the described vulnerability class and introduces minor uncertainty about whether there is an additional configuration-control dimension not captured in the description - this should be verified against SAP Note 3155685 before finalizing triage. Overall, this is a real but low-priority remediation item for organizations running SAP CRM, most appropriately addressed during a scheduled SAP patch cycle rather than as an emergency response.

An authenticated low-privileged SAP CRM user injects a malicious script payload into a CRM record, activity, or shareable link within the WebClient UI. When a victim user with a valid session navigates to or interacts with that content, the browser executes the script without CSP restriction, potentially enabling session manipulation, UI redirection, or limited data modification within the victim's browser context. No public exploit code has been identified at time of analysis, making opportunistic mass exploitation unlikely.