CVE-2025-26659: SAP SE SAP NetWeaver Application Server Abap Applications Based On SAP GUI For Html

Medium severity, CVSS 6.1. EPSS: 0.2% chance of exploitation in the next 30 days.

SAP NetWeaver Application Server ABAP does not sufficiently encode user-controlled inputs, leading to DOM-basedCross-Site Scripting (XSS) vulnerability. This allows an attacker with no privileges, to craft a malicious web message that exploits WEBGUI functionality. On successful exploitation, the malicious JavaScript payload executes in the scope of victim�s browser potentially compromising their data and/or manipulating browser content. This leads to a limited impact on confidentiality and integrity. There is no impact on availability

Affected products

• SAP SE SAP NetWeaver Application Server Abap Applications Based On SAP GUI For Html

Published 2025-03-11. Last modified 2026-06-17.