CVE-2026-89122

SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component. An unauthenticated attacker could craft a malicious link that, when clicked by a victim, loads attacker-controlled content within the trusted application context. Successful exploitation could allow the attacker to track user information and deface parts of the rendered page, resulting in a low impact on confidentiality and integrity with no impact on availability.

Score
CVSS 3.1 6.1 Medium
Status
Awaiting Analysis - cna@sap.com
Published
2026-10-13
Last modified
2026-10-15
Weaknesses
CWE-601

Affected products

References

 
 
© AVABIS GmbH privacypolicy about