PT-2026-2335 · Sap · Sap Netweaver Enterprise Portal

Published 2026-01-12 · Updated 2026-01-13 · CVE-2026-0499

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Enterprise Portal (affected versions not specified)

Description An unauthenticated attacker can inject malicious scripts into a URL parameter. These scripts are reflected in the server response and executed in a user's browser when a crafted URL is visited. This can lead to the theft of session information, manipulation of portal content, or user redirection. The impact on the application is low regarding confidentiality and integrity, with no impact on availability. The attack involves reflected cross-site scripting.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2026-00763

CVE-2026-0499

Affected Products

Sap Netweaver Enterprise Portal

References · 7

• https://bdu.fstec.ru/vul/2026-00763 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-0499 · Security Note
• https://support.sap.com/en/my-support/knowledge-base/security-notes-news/january-2026.html · Note
• https://url.sap/sapsecuritypatchday · Note
• https://twitter.com/CVEnew/status/2010911103996305562 · Twitter Post
• https://me.sap.com/notes/3687372 · Note
• https://twitter.com/VulmonFeeds/status/2010986033190486032 · Twitter Post