Executive brief
SAP NetWeaver Application Server Java, a foundational platform for running SAP business applications, is vulnerable to a security flaw that allows attackers to execute malicious scripts in a user's web browser. By tricking a user into clicking a specially crafted link, an attacker can steal sensitive session information or manipulate the data the user sees on their screen. This could lead to unauthorized access to business accounts or the theft of corporate data, though it does not directly crash the server.
Technical details
A Cross-Site Scripting (XSS) vulnerability exists in the Configuration Wizard (LMCTC 7.50) component of SAP NetWeaver Application Server Java. The flaw stems from improper neutralization of input during web page generation (CWE-79), allowing an unauthenticated remote attacker to inject malicious scripts via crafted URLs. Successful exploitation requires a victim to interact with the malicious link (User Interaction: Required). Once executed, the script runs within the context of the victim's browser session, enabling the attacker to bypass Same-Origin Policy (SOP) to access sensitive session tokens (High Confidentiality impact) and modify the DOM (Low Integrity impact). SAP has released security notes to address this issue as part of their July 2026 Patch Day.
Affected products
- SAP SE NetWeaver Application Server Java (Configuration Wizard) LMCTC 7.50
Timeline
- 2026-07-13: disclosed: Initial publication by SAP SE
- 2026-07-14: advisory: NVD publication date