CVE-2026-27674

Due to a Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java), an unauthenticated attacker could supply crafted input that is interpreted by the application and causes it to reference attacker-controlled content. If a victim accesses the affected functionality, that attacker-controlled content could be executed in the victim�s browser, potentially resulting in session compromise. This could allow the attacker to execute arbitrary client-side code, impacting the confidentiality and integrity of the application, with no impact to availability.

CVSS v3 6.1 MEDIUM

6.1^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://me.sap.com/notes/3719397	Permissions Required
https://url.sap/sapsecuritypatchday	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:sap:netweaver_application_server_java:7.50:*:*:*:*:*:*:*

History

26 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Debido a una vulnerabilidad de inyección de código en SAP NetWeaver Servidor de aplicaciones Java (Web Dynpro Java), un atacante no autenticado podría proporcionar una entrada manipulada que es interpretada por la aplicación y hace que haga referencia a contenido controlado por el atacante. Si una víctima accede a la funcionalidad afectada, ese contenido controlado por el atacante podría ejecutarse en el navegador de la víctima, lo que podría resultar en el compromiso de la sesión. Esto podría permitir al atacante ejecutar código arbitrario del lado del cliente, impactando la confidencialidad y la integridad de la aplicación, sin impacto en la disponibilidad.

Information

Published : 2026-04-14 00:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-27674

Mitre link : CVE-2026-27674

CVE.ORG link : CVE-2026-27674

JSON object : View

Products Affected

sap

netweaver_application_server_java

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2026-27674", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27674", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-04-14T00:00:00+00:00"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.8}]}, "affected": [{"source": "cna@sap.com", "affectedData": [{"vendor": "SAP_SE", "product": "SAP NetWeaver Application Server Java (Web Dynpro Java)", "versions": [{"status": "affected", "version": "WD-RUNTIME 7.50"}], "defaultStatus": "unaffected"}]}], "published": "2026-04-14T00:16:05.670", "references": [{"url": "https://me.sap.com/notes/3719397", "tags": ["Permissions Required"], "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "tags": ["Vendor Advisory"], "source": "cna@sap.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Due to a Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java), an unauthenticated attacker could supply crafted input that is interpreted by the application and causes it to reference attacker-controlled content. If a victim accesses the affected functionality, that attacker-controlled content could be executed in the victim\ufffds browser, potentially resulting in session compromise. This could allow the attacker to execute arbitrary client-side code, impacting the confidentiality and integrity of the application, with no impact to availability."}, {"lang": "es", "value": "Debido a una vulnerabilidad de inyecci\u00f3n de c\u00f3digo en SAP NetWeaver Servidor de aplicaciones Java (Web Dynpro Java), un atacante no autenticado podr\u00eda proporcionar una entrada manipulada que es interpretada por la aplicaci\u00f3n y hace que haga referencia a contenido controlado por el atacante. Si una v\u00edctima accede a la funcionalidad afectada, ese contenido controlado por el atacante podr\u00eda ejecutarse en el navegador de la v\u00edctima, lo que podr\u00eda resultar en el compromiso de la sesi\u00f3n. Esto podr\u00eda permitir al atacante ejecutar c\u00f3digo arbitrario del lado del cliente, impactando la confidencialidad y la integridad de la aplicaci\u00f3n, sin impacto en la disponibilidad."}], "lastModified": "2026-10-26T21:10:00.170", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:sap:netweaver_application_server_java:7.50:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9C506445-3787-4BFF-A98B-7502A0F7CF80"}], "operator": "OR"}]}], "sourceIdentifier": "cna@sap.com"}