CVE-2026-109810
CSS Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java)
SAP NetWeaver Application Server Java (Web Dynpro Java) does not sufficiently validate certain request parameters used to resolve styling resources in the application. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated victim, causes the victim's browser to load attacker-controlled styling content within the trusted application context. Successful exploitation could allow the attacker to redress the trusted user interface for phishing purposes and exfiltrate limited web page content, resulting in a low impact on confidentiality and integrity. There is no impact on availability.
| Vendor | sap_se |
| Product | sap netweaver application server java (web dynpro java) |
| Published | Nov 10, 2026 |
Get instant alerts for sap_se sap netweaver application server java (web dynpro java)
Be the first to know when new medium vulnerabilities affecting sap_se sap netweaver application server java (web dynpro java) are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N