CVE-2026-66779: SAP NetWeaver ABAP XSS Vulnerability

CVE-2026-66779 Overview

CVE-2026-66779 is a reflected Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP. An authenticated attacker can craft a malicious link that, when opened by another authenticated user, executes attacker-controlled script within the victim's browser context. The injected input is processed and reflected within the Document Object Model (DOM) during page rendering on the client side. Successful exploitation results in a high impact to confidentiality and a low impact to integrity, while availability is unaffected. The issue is tracked under [CWE-79] and was addressed in SAP Security Note #3721424.

Critical Impact
An authenticated attacker can hijack the victim's session context, exfiltrate sensitive ABAP application data, and issue limited actions on behalf of the victim within SAP NetWeaver.

Affected Products

SAP NetWeaver Application Server ABAP
SAP web-facing ABAP components exposing user-controllable input reflected into the DOM
Downstream SAP business applications hosted on affected NetWeaver ABAP stacks

Discovery Timeline

2026-08-11 - CVE-2026-66779 published to the National Vulnerability Database (NVD)
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-66779

Vulnerability Analysis

The vulnerability is a reflected XSS flaw ([CWE-79]) in the ABAP-based web components of SAP NetWeaver Application Server. User-supplied input is reflected into the DOM without adequate output encoding or sanitization. During page rendering, the browser interprets the attacker's payload as executable script rather than inert data.

Exploitation requires an authenticated attacker to craft a URL containing the malicious payload and share it with a target user. The target must also be authenticated and must click the link, giving the attack a user-interaction dependency. Once the victim's browser renders the page, the injected script runs in the origin of the SAP NetWeaver application.

The scope is unchanged, meaning the compromised component and impacted component share the same security authority. Confidentiality impact is rated high because the attacker can read session material, tokens, and application data accessible to the victim. Integrity impact is low because the attacker can perform limited state changes constrained by the victim's role.

Root Cause

The root cause is missing or insufficient contextual output encoding when reflecting user-controlled parameters into HTML or JavaScript contexts on server-rendered pages. Input intended as data is treated as markup, allowing script tags or event handlers to execute in the victim's session.

Attack Vector

The attack is delivered over the network and requires low complexity, low privileges, and user interaction. An authenticated attacker generates a malicious link and makes it publicly accessible or delivers it through phishing. When an authenticated victim opens the link, the reflected payload executes in the browser and can invoke SAP application endpoints under the victim's identity. No verified public proof-of-concept exploit has been published for this issue at the time of writing. See the SAP Security Note #3721424 for vendor guidance.

Detection Methods for CVE-2026-66779

Indicators of Compromise

HTTP requests to SAP NetWeaver ABAP endpoints containing URL parameters with <script>, javascript:, onerror=, or onload= substrings.
Referer headers pointing to external or untrusted domains before requests that return reflected content.
Anomalous outbound requests from browsers of SAP users to attacker-controlled hosts immediately after clicking SAP URLs.
Unexpected AJAX or XHR calls originating from authenticated SAP GUI web sessions to non-SAP endpoints.

Detection Strategies

Inspect web server and reverse proxy logs for query strings containing HTML or JavaScript control characters targeting /sap/bc/ paths.
Deploy Content Security Policy (CSP) violation reporting to surface unexpected inline script execution in SAP pages.
Correlate SAP Security Audit Log entries with web access logs to identify session activity that follows suspicious link clicks.

Monitoring Recommendations

Monitor SAP NetWeaver ICF (Internet Communication Framework) endpoints for parameter values containing encoded script fragments.
Alert on outbound HTTP requests from SAP application origins to newly registered or low-reputation domains.
Track user-agent and session anomalies in SAP web sessions, particularly session tokens used from multiple IP addresses in short intervals.

How to Mitigate CVE-2026-66779

Immediate Actions Required

Apply the patch referenced in SAP Security Note #3721424 to all affected NetWeaver ABAP systems.
Review the SAP Security Patch Day Update to identify related notes that must be applied together.
Audit recent SAP web access logs for reflected-payload patterns and revoke sessions of any user who interacted with suspicious links.
Enforce user awareness guidance that discourages clicking SAP URLs received from untrusted sources.

Patch Information

SAP addressed CVE-2026-66779 through SAP Security Note #3721424, released during SAP Security Patch Day. Customers must authenticate to the SAP for Me portal to download the note and apply the corresponding support package or kernel patch to the affected NetWeaver ABAP stack. Verify successful application through transaction SNOTE and validate that the patched components match the versions specified in the note.

Workarounds

Configure a restrictive Content Security Policy on SAP NetWeaver ICF services to block inline script execution where feasible.
Restrict access to affected web endpoints via reverse proxy or Web Application Firewall (WAF) rules that filter reflected script payloads.
Limit exposure of the SAP NetWeaver web interface to trusted network zones and VPN users until patching is complete.

bash

# Example WAF rule concept to block reflected script payloads on SAP paths
# (adapt to your WAF syntax; validate against legitimate SAP traffic)
SecRule REQUEST_URI "@beginsWith /sap/bc/" \
  "chain,phase:2,deny,status:403,id:1026667790,\
   msg:'Potential XSS payload targeting SAP NetWeaver (CVE-2026-66779)'"
  SecRule ARGS "@rx (?i)(<script|javascript:|onerror\s*=|onload\s*=)" "t:none,t:urlDecodeUni"