All vulnerabilities
CVE-2026-76976

Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)

SAP_SE SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)Applications & CMS
Open in ThreatlineRecord JSON
CVSS
5.4Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.14%Chance of exploitation activity in the next 30 days, higher than 2% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published13 Oct 2026Updated 13 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain functionality, allowing an authenticated attacker to send malicious content to another user. If the victim interacts with the affected content, malicious scripts could be executed in the victim's browser context. This vulnerability has a low impact on the confidentiality and integrity of the data and no impact on the availability of the application.

Text from CVE List

Affected versions 12

  • SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)affected: SAP_BASIS 731CVE List
  • SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)affected: SAP_BASIS 740CVE List
  • SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)affected: SAP_BASIS 750CVE List
  • SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)affected: SAP_BASIS 751CVE List
  • SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)affected: SAP_BASIS 752CVE List
  • SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)affected: SAP_BASIS 753CVE List
  • SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)affected: SAP_BASIS 754CVE List
  • SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)affected: SAP_BASIS 755CVE List
  • SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)affected: SAP_BASIS 756CVE List
  • SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)affected: SAP_BASIS 757CVE List
  • SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)affected: SAP_BASIS 758CVE List
  • SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)affected: SAP_BASIS 816CVE List

References 2