Description
SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal content, or user redirection. This results in a low impact on confidentiality and integrity. There is no impact on availability.
Published: 2026-10-13
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Reflected Cross‑Site Scripting (XSS)
Action: Patch
AI Analysis

Impact

The vulnerability in SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a victim’s browser when the crafted URL is visited. This can lead to session theft, unauthorized manipulation of portal content, or user redirection. The impact is low on confidentiality and integrity, with no availability impact.

Affected Systems

SAP NetWeaver Enterprise Portal is affected. Specific product versions are not listed, so all installations of this product should be evaluated for the presence of the referenced vulnerability.

Risk and Exploitability

The CVSS score of 6.1 indicates moderate severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting a lower overall exploitation probability. The attack vector is unauthenticated and utilizes reflected XSS, meaning an attacker only needs to trick a user into visiting a crafted URL; no prior access is required.

Generated by OpenCVE AI on October 13, 2026 at 03:00 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest patch for SAP NetWeaver Enterprise Portal as described in SAP Note 3779985.
  • Reconfigure the application to encode or sanitize all URL parameters before rendering them in the response.
  • Deploy a web application firewall or equivalent filtering engine to block reflected script payloads and enforce a strict content security policy.

Generated by OpenCVE AI on October 13, 2026 at 03:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 13 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 13 Oct 2026 07:30:00 +0000

Type Values Removed Values Added
First Time appeared Sap
Sap netweaver Enterprise Portal
Vendors & Products Sap
Sap netweaver Enterprise Portal

Tue, 13 Oct 2026 01:00:00 +0000

Type Values Removed Values Added
Description SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal content, or user redirection. This results in a low impact on confidentiality and integrity. There is no impact on availability.
Title Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Sap Netweaver Enterprise Portal
cve-icon MITRE

Status: PUBLISHED

Assigner: sap

Published:

Updated: 2026-10-13T13:28:29.984Z

Reserved: 2026-09-10T22:25:18.638Z

Link: CVE-2026-89117

cve-icon Vulnrichment

Updated: 2026-10-13T13:19:50.716Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-13T01:16:48.433

Modified: 2026-10-15T20:38:04.303

Link: CVE-2026-89117

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-13T07:15:15Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')