NetWeaver Enterprise Portal EUVD-2026-98197

Exploitation requires an attacker to deliver a crafted URL containing a malicious script in a vulnerable URL parameter of the SAP NetWeaver Enterprise Portal, and a legitimate portal user must actively visit that URL (UI:R) for the reflected payload to execute in their browser. No attacker authentication is required (PR:N), but the dependency on user interaction via social engineering (phishing/malicious link) is the primary limiting factor; impact is further bounded to the victim's browser session (session theft, content manipulation, redirection) with no availability impact. The specific vulnerable parameter/feature is not named in the description.

This is a reflected cross-site scripting flaw (CWE-79) with a CVSS 3.1 base score of 6.1 (MEDIUM). The provided vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N indicates a network-reachable, low-complexity, unauthenticated attack that nevertheless REQUIRES user interaction (UI:R) - the victim must open an attacker-crafted URL - and yields only low confidentiality and low integrity impact with a changed scope (the payload executes in the victim's browser rather than the server). No EPSS score, KEV listing, or POC indicator was supplied in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The signals are internally consistent: the MEDIUM CVSS correctly reflects a user-interaction-gated, limited-impact issue rather than a wormable server-side RCE. Realistic priority is moderate - meaningful for SAP-heavy enterprises because portal sessions can grant access to sensitive business functions, but this is not a drop-everything issue absent exploitation telemetry. Note: no EPSS/KEV/POC data was provided (not confirmed absent, simply not in the input), so exploitation-probability signals could not be weighed.

An attacker crafts a URL to the SAP NetWeaver Enterprise Portal containing a malicious script in a vulnerable parameter and delivers it to a portal user via phishing email or a malicious link. When the authenticated user clicks the link, the reflected script executes in their browser session, allowing the attacker to steal session cookies/tokens, alter displayed portal content, or redirect the user. No public exploit was identified in the provided data, so this scenario is inferred from the description and CVSS vector.