CVE-2026-44768: SAP CRM WebClient UI XSS Vulnerability

CVE-2026-44768 Overview

CVE-2026-44768 affects SAP Customer Relationship Management (CRM) WebClient UI. The application lacks a Content Security Policy (CSP) configuration for certain restrictive directives. An authenticated attacker can inject and execute malicious scripts in the context of the application. Successful exploitation requires user interaction and yields low impact to integrity, with no effect on confidentiality or availability. The weakness is classified under [CWE-15] (External Control of System or Configuration Setting) and stems from missing browser-side security controls. SAP addressed the issue as part of its regular Security Patch Day.

Critical Impact
Authenticated attackers can inject scripts that execute in the browser session of legitimate SAP CRM WebClient UI users, enabling limited tampering with application content.

Affected Products

SAP CRM WebClient UI (specific versions listed in SAP Note #3155685)

Discovery Timeline

2026-07-14 - CVE-2026-44768 published to the National Vulnerability Database (NVD)
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-44768

Vulnerability Analysis

The vulnerability resides in the SAP CRM WebClient UI, a browser-based interface that renders customer relationship management workflows. The application does not send certain restrictive Content Security Policy directives in its HTTP responses. Without these directives, browsers cannot enforce origin-based restrictions on script execution. An attacker who can influence content rendered by the application can inject client-side scripts that execute in the user's session context.

The attack requires low-level privileges and user interaction. The scope is changed, meaning the injected script executes outside the vulnerable component's original security context, affecting the browser environment of the victim. Impact is limited to integrity because injected scripts can modify rendered content or perform limited actions, but confidentiality and availability remain unaffected per the CVSS assessment.

Root Cause

The root cause is the absence of restrictive Content Security Policy headers such as default-src, script-src, or object-src in HTTP responses served by the WebClient UI. CSP acts as a defense-in-depth control that instructs browsers to block inline scripts and untrusted external resources. Without it, any content reflected or stored by the application can be interpreted and executed as script by the browser.

Attack Vector

An authenticated attacker with low privileges crafts a payload containing malicious JavaScript. The payload reaches the WebClient UI through an injection point such as a form field, URL parameter, or stored record. A victim user interacts with the affected view, and the browser executes the injected script in the application's origin. This vulnerability is network-exploitable and does not require local access.

No public proof-of-concept exploit is available at this time. The Exploit Prediction Scoring System (EPSS) probability is low, and the CVE is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-44768

Indicators of Compromise

Unusual outbound HTTP requests from user browsers to unfamiliar domains initiated from SAP CRM WebClient UI sessions
Unexpected DOM modifications or script tags observed in cached WebClient UI responses
Anomalous CRM record modifications performed by authenticated users through client-side automation

Detection Strategies

Inspect HTTP response headers from SAP CRM WebClient UI hosts and flag responses missing Content-Security-Policy directives
Deploy web application firewall (WAF) rules that detect <script> tags, javascript: URIs, and event handler payloads in CRM request parameters
Correlate authenticated user activity with anomalous browser behavior in endpoint telemetry

Monitoring Recommendations

Log and review all input fields in CRM forms that accept free-text values which are later rendered in the UI
Monitor SAP application server logs for suspicious parameter values containing HTML or JavaScript syntax
Enable browser-side CSP reporting endpoints to capture violation reports once the patch is applied

How to Mitigate CVE-2026-44768

Immediate Actions Required

Apply the patch referenced in SAP Note #3155685 during the next available maintenance window
Review the SAP Security Patch Day Announcement to identify related fixes that should be deployed together
Audit CRM user privileges and remove unnecessary access to reduce the pool of accounts that could exploit the flaw

Patch Information

SAP has released a corrective fix documented in SAP Note #3155685. The update adds the missing Content Security Policy directives to WebClient UI HTTP responses. Administrators should download the note from the SAP for Me portal and follow the version-specific implementation instructions.

Workarounds

Deploy a reverse proxy or web application firewall in front of the CRM WebClient UI to inject restrictive CSP headers into responses
Enforce strict input validation on CRM form fields to reject HTML and JavaScript syntax before storage
Restrict WebClient UI access to trusted network segments using network-level controls until the patch is applied

bash

# Example reverse proxy directive to inject a restrictive CSP header
# (adjust source allowlists to match your SAP CRM deployment)
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; frame-ancestors 'self'" always;