# CVE-2026-27680: SAP NetWeaver AS ABAP CSS injection due to improper input handling

Source: https://junglewise.ai/threats/cve-2026-27680-sap-netweaver-as-abap-css-injection-due-to-improper-input  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-14. Updated: 2026-06-03  
License: CC BY 4.0 with a link back

CVE-2026-27680 · Severity: low · CVSS 3.1 · Published 2026-05-14

SAP NetWeaver Application Server ABAP, a foundational platform for running SAP business applications, is vulnerable to a security flaw where an attacker can inject malicious styling code into web pages. If a user visits or interacts with a compromised page, the injected code could be used to subtly alter the page's appearance or potentially capture limited information. This issue primarily affects the privacy of user interactions but does not allow for full system takeover or data deletion.

Technologies: [SAP NetWeaver Application Server ABAP](https://junglewise.ai/threats/technologies/netweaver-application-server-abap). Vendors: [SAP](https://junglewise.ai/threats/vendors/sap).

## Quick answers

**Is CVE-2026-27680 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-27680 being exploited in the wild.

**How severe is CVE-2026-27680?** Low severity, with a CVSS score of 3.1, published 14 May 2026.

**Which products and versions are affected?** SAP NetWeaver Application Server ABAP 758, 816.

**Is there a fix for CVE-2026-27680?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-27680 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-27680?** Check whether you run SAP NetWeaver Application Server ABAP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A CSS injection vulnerability exists in SAP NetWeaver Application Server ABAP due to improper validation of user-supplied input. An unauthenticated remote attacker can exploit this by tricking a user into accessing a specially crafted URL or page, leading to the injection of custom Cascading Style Sheets (CSS) data. While the impact is limited to low confidentiality loss (such as potential data exfiltration via CSS selectors or UI redressing), it does not directly allow for script execution (XSS) or modification of application data. The vulnerability is tracked under SAP Security Note 3665042.

## Affected products

- SAP NetWeaver Application Server ABAP 758, 816

## Timeline

- 2026-05-14: disclosed
- 2026-05-14: advisory

## References

- [https://me.sap.com/notes/3665042](https://me.sap.com/notes/3665042)
- [https://url.sap/sapsecuritypatchday](https://url.sap/sapsecuritypatchday)

## Related threats

- [SAP Web Dispatcher and NetWeaver Application Server ABAP CSRF in administrative functionality](https://junglewise.ai/threats/cve-2026-89119-sap-web-dispatcher-and-sap-netweaver-application-server-abap)
- [SAP NetWeaver Application Server ABAP memory corruption denial of service](https://junglewise.ai/threats/cve-2026-76970-due-to-a-memory-corruption-vulnerability-in-application-server)
- [SAP NetWeaver Application Server ABAP authorization bypass](https://junglewise.ai/threats/cve-2026-76965-sap-netweaver-application-server-abap-and-abap-platform-does-not)
- [SAP NetWeaver Application Server ABAP memory corruption](https://junglewise.ai/threats/cve-2026-76964-sap-netweaver-application-server-abap-does-not-sufficiently)
- [SAP NetWeaver Application Server ABAP memory disclosure](https://junglewise.ai/threats/cve-2026-109796-sap-netweaver-application-server-abap-and-abap-platform-does-not)