CVE-2026-27674

EUVD-2026-22146

14.04.2026, 00:16

Due to a Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java), an unauthenticated attacker could supply crafted input that is interpreted by the application and causes it to reference attacker-controlled content. If a victim accesses the affected functionality, that attacker-controlled content could be executed in the victims browser, potentially resulting in session compromise. This could allow the attacker to execute arbitrary client-side code, impacting the confidentiality and integrity of the application, with no impact to availability.

Code Injection

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	6.1 MEDIUM	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Common Weakness Enumeration

CWE-94 - Improper Control of Generation of Code ('Code Injection')
The software constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Vulnerability Media Exposure

[GERMAN] SAP Patch Day April 2026: SQL-Injection-Lücke mit CVSS 9,9 erfordert sofortiges Handeln
Zum April-Patch-Day hat SAP 22 neue und aktualisierte Sicherheitshinweise veröffentlicht. Darunter befindet sich ein HotNews-Hinweis sowie zwei High-Priority-Hinweise. Fünf der insgesamt 18 neuen Hinweise entstanden in enger Zusammenarbeit mit den Onapsis Research Labs (ORL), die damit erneut einen substanziellen Beitrag zur Absicherung der SAP-Produktlandschaft geleistet haben. Der Beitrag SAP Patch Day April 2026: SQL-Injection-Lücke mit CVSS 9,9 erfordert sofortiges Handeln erschien zuerst auf All About Security Das Online-Magazin zu Cybersecurity (Cybersicherheit). Ransomware, Phishing, IT-Sicherheit, Netzwerksicherheit, KI, Threats, DDoS, Identity & Access, Plattformsicherheit .
Published: 2026-04-14T09:53:44+00:00

References

https://me.sap.com/notes/3719397

https://url.sap/sapsecuritypatchday