CVE-2026-27680
Low
Description
Due to improper input handling under certain conditions, SAP NetWeaver Application Server ABAP allows an attacker to inject custom Cascading Style Sheets (CSS) data into a web page served by the application. When a user accesses or clicks the affected page, the injected CSS is executed. As a result, the issue has a low impact on confidentiality, while integrity and availability are not impacted.
SeverityLow
CVSS3.1
Exploit probability—
Product
Sap Netweaver Application Server Abap
PublishedMay 14, 2026
First seenMay 14, 2026
Weakness typeCWE-276CWE-276
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| sap netweaver_application_server_abap | 758, 816 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.