Is CVE-2026-27680 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-27680 being exploited in the wild.

How severe is CVE-2026-27680?

Low severity, with a CVSS score of 3.1, published 14 May 2026.

Which products and versions are affected?

SAP NetWeaver Application Server ABAP 758, 816.

Is there a fix for CVE-2026-27680?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-27680 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-27680?

Check whether you run SAP NetWeaver Application Server ABAP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-27680: SAP NetWeaver AS ABAP CSS injection due to improper input handling

CVE-2026-27680 · Severity: low · CVSS 3.1 · Published 2026-05-14

SAP NetWeaver Application Server ABAP, a foundational platform for running SAP business applications, is vulnerable to a security flaw where an attacker can inject malicious styling code into web pages. If a user visits or interacts with a compromised page, the injected code could be used to subtly alter the page's appearance or potentially capture limited information. This issue primarily affects the privacy of user interactions but does not allow for full system takeover or data deletion.

Technologies: SAP NetWeaver Application Server ABAP. Vendors: SAP.

Quick answers

Is CVE-2026-27680 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-27680 being exploited in the wild.
How severe is CVE-2026-27680?: Low severity, with a CVSS score of 3.1, published 14 May 2026.
Which products and versions are affected?: SAP NetWeaver Application Server ABAP 758, 816.
Is there a fix for CVE-2026-27680?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-27680 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-27680?: Check whether you run SAP NetWeaver Application Server ABAP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A CSS injection vulnerability exists in SAP NetWeaver Application Server ABAP due to improper validation of user-supplied input. An unauthenticated remote attacker can exploit this by tricking a user into accessing a specially crafted URL or page, leading to the injection of custom Cascading Style Sheets (CSS) data. While the impact is limited to low confidentiality loss (such as potential data exfiltration via CSS selectors or UI redressing), it does not directly allow for script execution (XSS) or modification of application data. The vulnerability is tracked under SAP Security Note 3665042.

Affected products

SAP NetWeaver Application Server ABAP 758, 816

Timeline

2026-05-14: disclosed
2026-05-14: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.