CVE-2026-44746: SAP NetWeaver JAVA XSS Vulnerability

CVE-2026-44746 Overview

CVE-2026-44746 is a reflected cross-site scripting (XSS) vulnerability in the SAP NetWeaver JAVA JDBC Test Servlet. An unauthenticated attacker can craft a URL containing a malicious script payload. When a victim clicks the link, the servlet reflects the unsanitized input into the rendered web page, causing the browser to execute the attacker-controlled script. The flaw is tracked under CWE-79 and impacts confidentiality and integrity of the web client session, with no impact to availability. SAP addressed the issue in advisory SAP Note #3723655.

Critical Impact
A successful attack allows execution of attacker-controlled JavaScript in the victim's browser, enabling session data theft and unauthorized actions against the SAP NetWeaver web client.

Affected Products

SAP NetWeaver JAVA
JDBC Test Servlet component
Refer to SAP Note #3723655 for specific affected versions

Discovery Timeline

2026-06-09 - CVE CVE-2026-44746 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-44746

Vulnerability Analysis

The vulnerability resides in the JDBC Test Servlet shipped with SAP NetWeaver JAVA. The servlet accepts user-supplied input through URL parameters and reflects that input back into the response HTML without applying output encoding or input sanitization. An attacker constructs a URL embedding JavaScript and delivers it to a target user through phishing, chat, or other social channels. When the user clicks the link, the malicious payload executes in the context of the SAP NetWeaver application origin.

The attack requires user interaction, and the scope is changed because the injected script runs in the security context of the SAP web application. Successful exploitation grants the attacker read and write access to data accessible to the victim's session, including session tokens, form data, and any administrative state exposed through the servlet.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. The JDBC Test Servlet writes request parameters into HTTP response bodies without HTML-encoding special characters such as <, >, ", and '. This allows attacker-supplied markup to be parsed and executed by the victim's browser.

Attack Vector

The attack is network-based and requires no authentication. The attacker must convince a victim, who may have an active SAP NetWeaver session, to follow a crafted link. Once the victim's browser loads the response, the embedded script executes with access to the SAP application's DOM, cookies not marked HttpOnly, and session state. The JDBC Test Servlet endpoint should not be exposed to untrusted networks in production environments.

No verified public proof-of-concept code is available. Refer to SAP Security Patch Day for vendor guidance.

Detection Methods for CVE-2026-44746

Indicators of Compromise

HTTP requests to JDBC Test Servlet endpoints containing URL-encoded <script>, javascript:, onerror=, or onload= payloads in query parameters
Unusual referrers in NetWeaver access logs pointing to external or unknown domains immediately preceding administrative actions
Outbound browser requests from administrator workstations to attacker-controlled domains shortly after accessing SAP URLs

Detection Strategies

Inspect SAP NetWeaver JAVA HTTP access logs for requests targeting the JDBC Test Servlet path with suspicious query string content
Deploy web application firewall (WAF) rules that flag reflected XSS patterns in parameters submitted to SAP application endpoints
Correlate browser process telemetry on administrator endpoints with SAP URL visits to identify anomalous script execution

Monitoring Recommendations

Enable verbose HTTP request logging on all SAP NetWeaver JAVA frontends and forward logs to a centralized analytics platform
Alert on any access to JDBC test or diagnostic servlets from non-administrative source IPs
Track Content Security Policy (CSP) violation reports if CSP headers are configured on the NetWeaver application

How to Mitigate CVE-2026-44746

Immediate Actions Required

Apply the patch referenced in SAP Note #3723655 to all affected SAP NetWeaver JAVA instances
Restrict network access to the JDBC Test Servlet so it is reachable only from trusted administrative networks
Audit recent access logs for evidence of crafted URLs targeting the servlet and notify users who may have clicked suspicious links

Patch Information

SAP released the fix as part of SAP Security Patch Day. Administrators should review SAP Note #3723655 for the exact support package and patch level required for their NetWeaver JAVA release. Consult the SAP Security Patch Day portal for the complete advisory bundle.

Workarounds

Disable the JDBC Test Servlet in production environments where it is not required for operational use
Place SAP NetWeaver behind a reverse proxy or WAF configured to block requests containing script tags or JavaScript event handlers in query parameters
Enforce strict Content Security Policy headers to limit inline script execution within the NetWeaver application origin
Train administrators to avoid clicking SAP URLs originating from untrusted sources until patching is complete

bash

# Example WAF rule pattern to block reflected XSS payloads targeting the JDBC Test Servlet
# (ModSecurity-style pseudocode - adapt to your WAF syntax)
SecRule REQUEST_URI "@contains /JDBCTestServlet" \
  "chain,deny,status:403,id:1004474,msg:'Block suspected XSS on SAP JDBC Test Servlet'"
  SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=)"