Description
Due to a Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java), an unauthenticated attacker could supply crafted input that is interpreted by the application and causes it to reference attacker-controlled content. If a victim accesses the affected functionality, that attacker-controlled content could be executed in the victim�s browser, potentially resulting in session compromise. This could allow the attacker to execute arbitrary client-side code, impacting the confidentiality and integrity of the application, with no impact to availability.
Published: 2026-04-14
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Client-side code execution leading to session compromise
Action: Immediate Patch
AI Analysis

Impact

The vulnerability is a code injection flaw in SAP NetWeaver Application Server Java's Web Dynpro Java component. An unauthenticated attacker can send crafted input that the application interprets and renders as attacker-controlled content. When a user accesses the affected functionality, the injected content may run in the victim’s browser, allowing arbitrary client-side code execution. This can compromise the confidentiality and integrity of the user session, but does not affect application availability.

Affected Systems

SAP NetWeaver Application Server Java, specifically the Web Dynpro Java module. No specific version numbers are disclosed, so all instances of this component should be reviewed for potential exposure.

Risk and Exploitability

The CVSS score of 6.1 indicates moderate severity. No publicly available exploit data or catalog listing is referenced. The vulnerability can be triggered by an unauthenticated user delivering malicious input and requires the victim to access the vulnerable functionality for the injected content to execute.

Generated by OpenCVE AI on April 14, 2026 at 01:51 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the SAP security patch found in SAP Note 3719397
  • Verify that the Web Dynpro Java component is updated to the patched version
  • Refer to SAP Patch Day guidance to schedule maintenance for timely implementation

Generated by OpenCVE AI on April 14, 2026 at 01:51 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 14 Apr 2026 16:30:00 +0000

Type Values Removed Values Added
First Time appeared Sap
Sap sap Netweaver Application Server Java
Vendors & Products Sap
Sap sap Netweaver Application Server Java

Tue, 14 Apr 2026 14:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Tue, 14 Apr 2026 00:15:00 +0000

Type Values Removed Values Added
Description Due to a Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java), an unauthenticated attacker could supply crafted input that is interpreted by the application and causes it to reference attacker-controlled content. If a victim accesses the affected functionality, that attacker-controlled content could be executed in the victim�s browser, potentially resulting in session compromise. This could allow the attacker to execute arbitrary client-side code, impacting the confidentiality and integrity of the application, with no impact to availability.
Title Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java)
Weaknesses CWE-94
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Sap Sap Netweaver Application Server Java
cve-icon MITRE

Status: PUBLISHED

Assigner: sap

Published:

Updated: 2026-04-14T13:14:18.897Z

Reserved: 2026-02-23T17:50:10.513Z

Link: CVE-2026-27674

cve-icon Vulnrichment

Updated: 2026-04-14T13:09:20.842Z

cve-icon NVD

Status : Received

Published: 2026-04-14T00:16:05.670

Modified: 2026-04-14T00:16:05.670

Link: CVE-2026-27674

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-14T16:31:28Z

Weaknesses