SAP NetWeaver ABAP CVE-2026-76976

Exploitation requires an authenticated SAP account (PR:L) with access to the specific SAP GUI for HTML functionality that mishandles user-supplied content, plus a victim who actively interacts with the attacker-injected content (UI:R) inside a SAP GUI for HTML application on SAP NetWeaver AS ABAP. Limiting factors that reduce realistic risk: the attacker cannot act fully unauthenticated, the payload only fires when a second user views the malicious content, and impact is confined to the victim's browser session (low confidentiality/integrity, no availability impact). Effective exploitation typically targets a higher-privileged victim to gain meaningful value from the script execution.

This is a medium-severity stored/reflected cross-site scripting flaw (CWE-79) in SAP GUI for HTML applications on SAP NetWeaver AS ABAP, rated CVSS 5.4. The CVSS vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N) shows network reach and low complexity, but two meaningful brakes on real-world risk: the attacker must already hold valid low-level credentials (PR:L) and a victim must actively interact with the malicious content (UI:R). The scope change (S:C) reflects that injected script executes in the victim's browser context - a different security authority than the vulnerable component - while impact is limited to low confidentiality and low integrity with no availability effect. No EPSS score, CISA KEV listing, or public POC was provided in the input, so there is no signal of active exploitation or widespread weaponization. Weighing these signals together, this is a real but not emergency-tier issue: the authentication-plus-interaction requirement makes it better suited to targeted attacks (e.g., a malicious insider or compromised low-privilege account phishing a higher-privileged SAP user) than mass exploitation. No key data points directly conflict, but the absence of EPSS/KEV/POC data means prioritization leans on the moderate CVSS alone; patch urgency should align with SAP's own Patch Day guidance rather than active-exploitation pressure.

An attacker with a low-privilege authenticated SAP account submits crafted content containing malicious JavaScript into a SAP GUI for HTML function that fails to sanitize user-supplied input. When a targeted colleague or administrator later views that content in their browser, the script executes in their authenticated SAP session, enabling session-context actions such as reading or manipulating data the victim can access. No public exploit code was identified at time of analysis, and successful exploitation depends on the victim interacting with the attacker-supplied content.