CVE-2026-44757

SAP Wily Introscope Enterprise Manager allows an unauthenticated attacker to craft a specially crafted URL. Under certain conditions, when accessed by a victim, the injected script could execute in the user�s browser within the context of the application. This issue has a low impact on the confidentiality and integrity of the application with no impact on availability.

CVSS v3 4.7 MEDIUM

4.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://me.sap.com/notes/3715280
https://url.sap/sapsecuritypatchday

Configurations

No configuration.

History

No history.

Information

Published : 2026-06-09 01:16

Updated : 2026-07-23 08:10

NVD link : CVE-2026-44757

Mitre link : CVE-2026-44757

CVE.ORG link : CVE-2026-44757

JSON object : View

Products Affected

No product.

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2026-44757", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44757", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-09T14:32:11.478229Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@sap.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.6}]}, "affected": [{"source": "cna@sap.com", "affectedData": [{"vendor": "SAP_SE", "product": "SAP Wily Introscope Enterprise Manager", "versions": [{"status": "affected", "version": "WILY_INTRO_ENTERPRISE 10.8"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-09T01:16:47.337", "references": [{"url": "https://me.sap.com/notes/3715280", "source": "cna@sap.com"}, {"url": "https://url.sap/sapsecuritypatchday", "source": "cna@sap.com"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "cna@sap.com", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "SAP Wily Introscope Enterprise Manager allows an unauthenticated attacker to craft a specially crafted URL. Under certain conditions, when accessed by a victim, the injected script could execute in the user\ufffds browser within the context of the application. This issue has a low impact on the confidentiality and integrity of the application with no impact on availability."}, {"lang": "es", "value": "SAP Wily Introscope Enterprise Manager permite a un atacante no autenticado crear una URL especialmente dise\u00f1ada. Bajo ciertas condiciones, cuando es accedido por una v\u00edctima, el script inyectado podr\u00eda ejecutarse en el navegador del usuario dentro del contexto de la aplicaci\u00f3n. Este problema tiene un bajo impacto en la confidencialidad e integridad de la aplicaci\u00f3n, sin impacto en la disponibilidad."}], "lastModified": "2026-07-23T08:10:00.137", "sourceIdentifier": "cna@sap.com"}