CVE-2022-39799: SAP NetWeaver Application Server Abap

Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days.

An attacker with no prior authentication could craft and send malicious script to SAP GUI for HTML within Fiori Launchpad, resulting in reflected cross-site scripting attack. This could lead to stealing session information and impersonating the affected user.

Affected products

• SAP NetWeaver Application Server Abap: version 7.54 only; version 7.81 only; version 7.85 only; version 7.89 only; version kernel_7.77 only

Published 2022-09-13. Last modified 2026-06-17.