CVE-2026-120016

Overview

SAP NetWeaver Visual Composer is vulnerable to cross‑site scripting due to insufficient input validation and output encoding. An unauthenticated attacker can craft a malicious link that, when clicked by a user, executes arbitrary script in the victim’s browser within the application context. This flaw can compromise confidentiality and integrity of data accessed by the user.

Description

SAP NetWeaver Visual Composer does not perform sufficient input validation and output encoding on certain request data. An unauthenticated attacker could craft a malicious link containing specially crafted input. If a victim clicks the link, the injected script executes in the victim's browser within the context of the affected application. This results in a low impact on confidentiality and integrity. There is no impact on availability.

Impact

The vulnerability allows attackers to inject and execute scripts in the victim’s browser, potentially exposing sensitive data or modifying the user session. Confidentiality and integrity of information accessed by the user may be compromised. Availability is not affected.

Remediation

Apply the latest SAP security patch for NetWeaver Visual Composer from the SAP Support Portal. Verify that the patch includes proper input validation and output encoding. Configure a Content Security Policy (CSP) to restrict script sources, and enable input sanitization in the application. Monitor web traffic for suspicious XSS payloads and enforce strict browser security headers.

Risk context

The CVSS v3 score of 6.1 indicates a medium severity risk. With no EPSS data available, defenders should treat this as a moderate priority and apply the patch promptly to mitigate potential XSS attacks.

Affected products

• SAP NetWeaver Visual Composer