CVE-2024-22126: SAP NetWeaver Application Server Java

Medium severity, CVSS 6.1. EPSS: 0.5% chance of exploitation in the next 30 days.

The User Admin application of SAP NetWeaver AS for Java - version 7.50, insufficiently validates and improperly encodes the incoming URL parameters before including them into the redirect URL. This results in Cross-Site Scripting (XSS) vulnerability, leading to a high impact on confidentiality and mild impact on integrity and availability.

Affected products

• SAP NetWeaver Application Server Java: version 7.50 only

Published 2024-02-13. Last modified 2026-06-17.