SAP NetWeaver ABAP CVE-2026-66779

The attacker must hold a valid, authenticated SAP NetWeaver account with at least low-level access (PR:L) sufficient to access and craft URLs for the affected web endpoint. The victim must also be an authenticated SAP user and must actively access the attacker-crafted link (UI:R), typically via social engineering such as phishing or internal messaging. The vulnerability is within the DOM rendering path of specific NetWeaver web components (AJAX-RUNTIME, EP-FLP, SAP_UI, SAP_BASIS), meaning exposure depends on these components being active and accessible. Exploitation is limited by the following factors: both parties require valid SAP credentials, victim must click a link (not passive), and no special non-default configuration appears required beyond running an affected component version. The attack does not require network adjacency or physical access, as it operates fully over HTTP/HTTPS (AV:N).

The CVSS base score of 6.3 (Medium) accurately reflects the realistic exploitation difficulty: the attacker must hold a valid SAP account (PR:L) and must socially engineer an authenticated victim into clicking a crafted link (UI:R), limiting opportunistic mass exploitation. The high confidentiality impact (C:H) is the primary driver of concern - successful exploitation can expose session tokens or sensitive business data processed within the victim's browser context. Availability is unaffected (A:N). No EPSS score was available in the provided data, so probability-based prioritization cannot be anchored numerically. No CISA KEV listing and no known public POC reduce the urgency compared to actively exploited issues. The combination of PR:L on the attacker side and UI:R on the victim side means exploitation is plausible but not trivially automatable, making this a targeted-attack scenario rather than a mass-exploitation risk. The scope is unchanged (S:U), indicating the JavaScript executes within the SAP web application's browser context without breaking into other origins. Overall: real risk to organizations where SAP users are susceptible to phishing or internal social engineering, but not an emergency patch priority absent a specific threat indicator.

An authenticated SAP user with low-privilege access crafts a URL targeting a vulnerable NetWeaver ABAP web endpoint, embedding a JavaScript payload in a query parameter that is reflected unsanitized into the DOM. The attacker distributes this link via internal email, a SAP message, or a shared document to a higher-privileged authenticated SAP user. When the victim opens the link in their browser session, the malicious script executes and exfiltrates their SAP session cookie or triggers actions on their behalf within the SAP application. No public proof-of-concept code has been identified, but the attack pattern is well-understood for DOM-reflected XSS.