SAP NetWeaver AS Java EUVD-2026-43587

Exploitation requires the attacker to deliver a crafted URL targeting the SAP NetWeaver AS Java Configuration Wizard component and a victim to actively open that URL in a browser (CVSS UI:R - required user interaction is the primary limiting factor). No authentication is required of the attacker (PR:N), and the attack is network-reachable with low complexity (AV:N/AC:L). The concrete limiting conditions are: the vulnerable Configuration Wizard endpoint must be reachable by the victim's browser (internet exposure or shared network), the victim must have a session/context worth stealing, and successful impact is maximized when the victim is an authenticated SAP user, since the injected script runs in their browser's security context. This is not exploitable fully unattended - it is a social-engineering-gated reflected XSS, not a self-propagating or drive-by mass exploit.

The CVSS 3.1 base score is 8.2 (High) with vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N: network-reachable, low complexity, no privileges, but requiring user interaction (a victim must open the crafted URL). The high confidentiality impact and scope change elevate it above a typical reflected XSS, reflecting session/token exposure. Countervailing signals: exploitation is not automatable at scale because it depends on social engineering a specific victim to click a link, and there is no impact on availability and only low integrity impact. No EPSS score was provided in the input, no CISA KEV listing, and no public proof-of-concept - so this is currently a high-CVSS issue without evidence of active or widespread exploitation. Treat it as a real but interaction-gated priority: patch on the normal SAP Security Patch Day cadence and prioritize for internet-facing NetWeaver Java instances rather than as an emergency drop-everything item, since no in-the-wild exploitation or automatable mass-exploit vector is confirmed by the available data.

An attacker crafts a URL targeting a victim organization's internet-facing SAP NetWeaver AS Java Configuration Wizard endpoint, embedding malicious JavaScript in a reflected parameter, and delivers it via phishing email or chat to an SAP administrator or user. When the victim clicks the link, the script runs in their authenticated SAP browser session, exfiltrating session information and manipulating displayed data. No public proof-of-concept is identified, and success depends on the victim opening the link (UI:R).