CVE-2026-27680

CSS Injection vulnerability in SAP NetWeaver Application Server ABAP

View on CVE.org
Published May 14, 2026 CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed
Description
Due to improper input handling under certain conditions, SAP NetWeaver Application Server ABAP allows an attacker to inject custom Cascading Style Sheets (CSS) data into a web page served by the application. When a user accesses or clicks the affected page, the injected CSS is executed. As a result, the issue has a low impact on confidentiality, while integrity and availability are not impacted.

Analysis

AI-generated

Technical impact

The vulnerability arises from improper handling of user input that is incorporated into a web page. Under specific conditions an attacker can inject custom Cascading Style Sheet code; when a victim opens or clicks the affected page the injected CSS is executed by the browser. This type of injection does not expose data nor change system state, leading to a minimal confidentiality impact while leaving integrity and availability untouched. The weakness is classified as CWE‑276.

Affected Systems

SAP NetWeaver Application Server ABAP, as identified by SAP SE. The CVE does not list specific product versions, so all deployed instances of this application server should be checked against SAP Note 3665042 for applicability.

Risk and Exploitability

The CVSS score of 3.1 reflects the low severity. No EPSS score is available, and the flaw is not listed in CISA’s KEV catalog. The exploitation requires that a user navigate to or interact with the affected page, so user interaction is a prerequisite. Given the low intrinsic severity and the need for manual interaction, the overall risk is considered low to moderate and the likelihood of widespread exploitation is low.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest SAP security update referenced in SAP Note 3665042 to patch the CSS injection flaw.
  • Implement input validation that rejects or escapes CSS‑specific characters in any data that may be rendered as style information.
  • Configure a web application firewall or apply a strict Content Security Policy to block the injection of arbitrary CSS styles in web responses.

Generated by OpenCVE AI on May 14, 2026 at 20:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
First Time appeared Sap netweaver Application Server Abap
CPEs cpe:2.3:a:sap:netweaver_application_server_abap:758:*:*:*:sap_ui:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:816:*:*:*:*:*:*:*
Vendors & Products Sap netweaver Application Server Abap
Type Values Removed Values Added
First Time appeared Sap
Sap sap Netweaver Application Server Java
Vendors & Products Sap
Sap sap Netweaver Application Server Java
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description Due to improper input handling under certain conditions, SAP NetWeaver Application Server ABAP allows an attacker to inject custom Cascading Style Sheets (CSS) data into a web page served by the application. When a user accesses or clicks the affected page, the injected CSS is executed. As a result, the issue has a low impact on confidentiality, while integrity and availability are not impacted.
Title CSS Injection vulnerability in SAP NetWeaver Application Server ABAP
Weaknesses CWE-276
References
Metrics cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N'}
Weaknesses
  • CWE-276

    Incorrect Default Permissions

Sources

Status
PUBLISHED
Assigner
sap
Published
Updated
May 14, 2026, 7:17 PM
Reserved
Feb 23, 2026, 5:50 PM

View source JSON

Updated
May 14, 2026, 7:17 PM

JSON

Status
Analyzed
Published
May 14, 2026, 7:16 PM
Modified
Oct 26, 2026, 2:10 PM

View source JSON

No data.

Updated
May 17, 2026, 7:30 PM

JSON