CVE-2026-44760: SAP NetWeaver ABAP XSS Vulnerability

CVE-2026-44760 Overview

CVE-2026-44760 is a reflected Cross-Site Scripting (XSS) vulnerability affecting applications built on the Business Server Pages (BSP) framework in SAP NetWeaver Application Server ABAP. The framework reflects unsanitized user input directly into HTTP responses, allowing an attacker to inject and execute arbitrary JavaScript in the victim's browser session. Successful exploitation can enable session information theft and authenticated actions performed on behalf of the targeted user. The vulnerability is classified as an Improper Neutralization of Input During Web Page Generation weakness [CWE-79].

Critical Impact
Attackers can execute arbitrary JavaScript in the context of an authenticated SAP user, enabling session hijacking and unauthorized actions within the SAP application.

Affected Products

SAP NetWeaver Application Server ABAP
Applications based on the Business Server Pages (BSP) framework
SAP environments exposing BSP applications over HTTP/HTTPS

Discovery Timeline

2026-07-14 - CVE-2026-44760 published to NVD
2026-07-14 - Last updated in NVD database
SAP Security Patch Day - SAP released fix via SAP Note #3754659

Technical Details for CVE-2026-44760

Vulnerability Analysis

The vulnerability resides in the Business Server Pages framework, a server-side technology in SAP NetWeaver AS ABAP used to build web applications that render HTML dynamically from ABAP logic. BSP applications accept parameters from HTTP requests and render them into response pages. When these parameters are echoed back without proper output encoding, an attacker can inject HTML and JavaScript payloads that execute in the victim's browser.

Exploitation requires user interaction, typically achieved by tricking an authenticated SAP user into clicking a crafted URL. The attack complexity is high because the attacker must satisfy specific conditions related to the vulnerable BSP application flow. Once executed, the injected script runs in the origin of the SAP application and inherits the victim's session context.

Root Cause

The root cause is missing or insufficient output encoding when BSP applications reflect request parameters into generated HTML. Input received via query strings, form fields, or path parameters is written into the HTTP response without contextual escaping for HTML, attribute, or JavaScript contexts, violating standard output-encoding requirements for [CWE-79].

Attack Vector

The attack vector is network-based and relies on social engineering. An attacker crafts a URL to a vulnerable BSP endpoint containing a JavaScript payload in a reflected parameter. The attacker delivers this URL through phishing email, chat, or a malicious website. When the authenticated victim opens the link, the SAP server reflects the payload into the response, and the browser executes it. The scope is changed because script executed in the SAP origin can access resources beyond the vulnerable component, such as session cookies and cross-frame content.

No verified public proof-of-concept code is available for this vulnerability. Refer to SAP Note #3754659 for vendor technical details.

Detection Methods for CVE-2026-44760

Indicators of Compromise

HTTP request logs containing <script>, javascript:, onerror=, or URL-encoded equivalents in parameters sent to BSP application paths
Outbound requests from user browsers to attacker-controlled domains immediately following access to SAP BSP URLs
Unexpected session activity or actions performed by users shortly after clicking external links to SAP hostnames

Detection Strategies

Inspect SAP Web Dispatcher and ICM access logs for suspicious query strings targeting /sap/bc/bsp/ paths containing HTML or JavaScript tokens
Deploy Web Application Firewall (WAF) rules that flag reflected XSS payload signatures against SAP NetWeaver endpoints
Correlate email gateway telemetry with SAP URL access to identify phishing campaigns leveraging crafted BSP links

Monitoring Recommendations

Enable verbose HTTP request logging on SAP Internet Communication Manager (ICM) for BSP applications
Monitor browser Content Security Policy (CSP) violation reports from SAP domains for injected inline scripts
Alert on anomalous authenticated actions such as privilege changes or data exports that follow unusual URL access patterns

How to Mitigate CVE-2026-44760

Immediate Actions Required

Apply the fix documented in SAP Note #3754659 via the SAP Security Patch Day release
Inventory all BSP-based applications exposed on internal and external networks and prioritize patching internet-facing systems
Educate SAP users on the risk of clicking untrusted links that reference SAP hostnames

Patch Information

SAP has released a corrective patch through SAP Note #3754659. Administrators should review the note in the SAP ONE Support Launchpad, apply the associated Support Package or correction instructions, and validate the fix in non-production before rolling to production. Consult the SAP Security Patch Day portal for the corresponding advisory bulletin.

Workarounds

Restrict access to BSP applications through network segmentation and reverse proxy allowlists where patching is delayed
Deploy WAF signatures that block requests containing common XSS payload patterns targeting SAP BSP paths
Enforce a strict Content Security Policy on SAP web responses to limit inline script execution and reduce exploitation impact

bash

# Example WAF rule pattern (ModSecurity) to block reflected XSS attempts on BSP endpoints
SecRule REQUEST_URI "@beginsWith /sap/bc/bsp/" \
  "chain,phase:2,deny,status:403,id:1004476,msg:'Potential XSS against SAP BSP (CVE-2026-44760)'"
  SecRule ARGS "@rx (?i)(<script|javascript:|onerror=|onload=)" "t:urlDecodeUni,t:htmlEntityDecode"