PT-2026-2335 · Sap · Sap Netweaver Enterprise Portal

Publicado 2026-01-12 · Atualizado 2026-01-13 · CVE-2026-0499

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Enterprise Portal (affected versions not specified)

Description An unauthenticated attacker can inject malicious scripts into a URL parameter. These scripts are reflected in the server response and executed in a user's browser when a crafted URL is visited. This can lead to the theft of session information, manipulation of portal content, or user redirection. The impact on the application is low regarding confidentiality and integrity, with no impact on availability. The attack involves reflected cross-site scripting.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2026-00763

CVE-2026-0499

Produtos afetados

Sap Netweaver Enterprise Portal

Referências · 7

• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/january-2026.html · Nota
• https://bdu.fstec.ru/vul/2026-00763 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2026-0499 · Nota de Segurança
• https://url.sap/sapsecuritypatchday · Nota
• https://twitter.com/CVEnew/status/2010911103996305562 · Publicação no Twitter
• https://me.sap.com/notes/3687372 · Nota
• https://twitter.com/VulmonFeeds/status/2010986033190486032 · Publicação no Twitter