SAP Data Services EUVD-2026-55862

Exploitation requires the attacker to hold an authenticated low-privilege account on SAP Data Services Management Console (PR:L per CVSS vector). High attack complexity (AC:H) is imposed by the chaining requirement: the CSP weakness alone is not exploitable - a second, distinct vulnerability capable of injecting content into the application must also be present and reachable. User interaction (UI:R) is mandatory - a victim user with sufficient privileges must actively visit or interact with the attacker-influenced page in their browser session. Exploitation is therefore bounded by: authenticated attacker access, the concurrent presence and exploitability of a separate injection vulnerability, and a social engineering or session-targeting step to involve a victim user. Default-configuration deployments without a co-present XSS or injection flaw are not directly exploitable via this CSP weakness alone.

The CVSS base score of 3.7 (Low) with vector AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N accurately reflects the constrained exploitability of this issue: high attack complexity is warranted because the CSP weakness cannot be exploited in isolation - it requires chaining with a separate vulnerability to achieve script injection. Authenticated access (PR:L) and user interaction (UI:R) are mandatory, further limiting the realistic attacker population to insiders or compromised accounts. No EPSS score was provided in source intelligence, and the vulnerability carries no CISA KEV designation and no known public exploit code, placing its real-world priority well below headline severity. The low C:L/I:L impact ceiling means even successful exploitation yields limited data exposure or tamper capability - session hijacking or credential theft would require additional conditions. This is a defense-in-depth control gap rather than an immediately weaponizable flaw; the absence of a strong CSP increases the blast radius of any future XSS vulnerability discovered in the same product. Even an organisation with a modest SAP footprint should treat it as a scheduled patch-cycle item rather than emergency response, consistent with SAP's own patch day disclosure cadence.

An authenticated attacker with low-privilege access to the Management Console identifies a separate injection point - such as a stored XSS sink in a data services job or dataset name field - that the absent CSP would otherwise have neutralised. The attacker crafts a payload that injects a script tag or event handler, then socially engineers or waits for an administrator-level user to navigate to the affected page, triggering script execution in the admin's browser session and potentially harvesting session tokens or performing administrative actions on behalf of the victim. No public proof-of-concept exploit code has been identified at time of analysis.