CVE-2026-76976: sap_se sap netweaver application server abap (applications based on sap gui for html) Cross-site Scripting

Vulnerability summary

CVE-2026-76976 is a medium (CVSS 5.4) Cross-site Scripting vulnerability in sap_se sap netweaver application server abap (applications based on sap gui for html). EPSS estimates a 0.14% chance of exploitation in the next 30 days, higher than 2.9% of scored vulnerabilities.

Timeline

1. 13-10-2026
   PublishedVulnerability first disclosed.
2. 13-10-2026
   Last modifiedVulnerability information updated.

Description

Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain functionality, allowing an authenticated attacker to send malicious content to another user. If the victim interacts with the affected content, malicious scripts could be executed in the victim's browser context. This vulnerability has a low impact on the confidentiality and integrity of the data and no impact on the availability of the application.

• CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.