What is the CVSS score of EUVD-2026-22146?

EUVD-2026-22146 has a CVSS 3.1 base score of 6.1 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Java EUVD-2026-22146

| CVE-2026-27674 MEDIUM

Code Injection (CWE-94)

2026-04-14 cna@sap.com

GHSA-2c34-jhww-wwcm

SAP Code Injection RCE Java

6.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.1 MEDIUM

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 14, 2026 - 00:25 vuln.today

EUVD ID Assigned

Apr 14, 2026 - 00:22 euvd

EUVD-2026-22146

Analysis Generated

Apr 14, 2026 - 00:22 vuln.today

CVE Published

Apr 14, 2026 - 00:16 nvd

MEDIUM 6.1

DescriptionCVE.org

Due to a Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java), an unauthenticated attacker could supply crafted input that is interpreted by the application and causes it to reference attacker-controlled content. If a victim accesses the affected functionality, that attacker-controlled content could be executed in the victim�s browser, potentially resulting in session compromise. This could allow the attacker to execute arbitrary client-side code, impacting the confidentiality and integrity of the application, with no impact to availability.

AnalysisAI

Cross-site scripting via code injection in SAP NetWeaver Application Server Java Web Dynpro allows unauthenticated remote attackers to inject arbitrary client-side code through crafted input, compromising user sessions and application data integrity when victims interact with the affected functionality. CVSS 6.1 (medium) reflects the requirement for user interaction and limited scope, but exploitation is straightforward with no authentication needed and low attack complexity.

Technical ContextAI

SAP NetWeaver Application Server Java uses Web Dynpro as a UI framework for building enterprise applications. The vulnerability stems from CWE-94 (code injection), where user-supplied input is not properly sanitized before being interpreted and rendered in the victim's browser context. This occurs in the Web Dynpro Java component, which processes dynamic UI generation and request handling. Unlike typical stored XSS, this code injection vulnerability allows attackers to craft input that causes the application itself to reference and execute attacker-controlled content, bypassing some client-side filtering that might block direct script tags. The attack surface is unauthenticated endpoints within Web Dynpro, making it accessible to any remote user without credentials.

RemediationAI

Apply the security patch released by SAP as documented in SAP Security Note 3719397 and the SAP Security Patch Day advisory (https://url.sap/sapsecuritypatchday). Organizations should review the SAP advisory to identify the specific patched version applicable to their NetWeaver release and apply it immediately, as the vulnerability is unauthenticated and can be exploited remotely. If patching cannot be completed immediately, restrict network access to affected Web Dynpro endpoints via firewall rules or disable Web Dynpro functionality until patches are deployed. Input validation on the client and server side should be audited to ensure all user-supplied data is properly escaped before being rendered in HTML or JavaScript contexts.