What’s Vulnerable › Vulnerabilities

CVE-2025-26659: Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML)

• Severity: medium (CVSS 6.1 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-03-11 · updated 2026-06-17
• Weakness: CWE-79

Description

SAP NetWeaver Application Server ABAP does not sufficiently encode user-controlled inputs, leading to DOM-basedCross-Site Scripting (XSS) vulnerability. This allows an attacker with no privileges, to craft a malicious web message that exploits WEBGUI functionality. On successful exploitation, the malicious JavaScript payload executes in the scope of victim�s browser potentially compromising their data and/or manipulating browser content. This leads to a limited impact on confidentiality and integrity. There is no impact on availability

Affected products

• SAP_SE SAP NetWeaver Application Server for ABAP and ABAP Platform: KRNL64UC 7.53, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, KERNEL 7.89, KERNEL 7.93 (+1)

References

• https://me.sap.com/notes/3552824
• https://url.sap/sapsecuritypatchday

Get alerted when CVE-2025-26659 or the next vulnerability affects your stack