Code Injection Vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java)

Vulnerability:

SAP NetWeaver Application Server Java (Web Dynpro Java) contains a Code Injection vulnerability that allows an unauthenticated attacker to supply crafted input that is interpreted by the application and causes it to reference attacker-controlled content. If a victim accesses the affected functionality, that attacker-controlled content could be executed in the victim’s browser, potentially resulting in session compromise.

The root cause lies in insufficient input validation and sanitization within the Web Dynpro Java component. The application accepts user-controlled input and incorporates it into content that is later served to other users without properly neutralizing potentially malicious code or references. The vulnerability is classified under CWE-94 (Improper Control of Generation of Code / Code Injection). The attack is initiated remotely over the network and requires no authentication, though user interaction is necessary for the injected content to execute in the victim’s browser context.

Impact:

This vulnerability allows a remote, unauthenticated attacker to execute arbitrary client-side code in the browsers of users accessing the affected SAP NetWeaver functionality. As a result:

• Session Compromise: Attacker-controlled code runs in the victim’s browser context, potentially capturing session tokens, credentials, or other sensitive data.
• Confidentiality Impact: Sensitive data visible within the victim’s authenticated SAP session may be silently exfiltrated to attacker-controlled servers.
• Integrity Impact: Malicious scripts can alter the application’s content, inject fraudulent UI elements, or redirect users to phishing pages.
• Credential Harvesting: Injected scripts can capture keystrokes, form submissions, or authentication tokens entered by the victim during the session.
• Persistent Attack Surface: If stored XSS is achievable, each subsequent user accessing the affected Web Dynpro component becomes a victim without further attacker interaction.

CVE ID:

CVE-2026-27674

Vendor:

SAP

Product:

SAP NetWeaver Application Server Java (Web Dynpro Java)

CVSS Score:

Base CVSS Score: 6.1 Medium

CVSS Base Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Disclosure Timeline

Reported to Vendor – 29th Jan 2026
CVE ID Reserved – 23th Feb, 2026
CVE Published – 13th Apr, 2026

Credits:
Chandru R – Payatu Security Consulting Pvt. Ltd.