CVE-2026-27674

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-27674", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2026-02-23T17:50:10.513Z", "datePublished": "2026-04-14T00:06:50.301Z", "dateUpdated": "2026-04-15T03:58:11.103Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-04-14T00:06:50.301Z"}, "title": "Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java)", "problemTypes": [{"descriptions": [{"lang": "eng", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code", "type": "CWE"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP NetWeaver Application Server Java (Web Dynpro Java)", "versions": [{"status": "affected", "version": "WD-RUNTIME 7.50"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "Due to a Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java), an unauthenticated attacker could supply crafted input that is interpreted by the application and causes it to reference attacker-controlled content. If a victim accesses the affected functionality, that attacker-controlled content could be executed in the victim\ufffds browser, potentially resulting in session compromise. This could allow the attacker to execute arbitrary client-side code, impacting the confidentiality and integrity of the application, with no impact to availability.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>Due to a Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java), an unauthenticated attacker could supply crafted input that is interpreted by the application and causes it to reference attacker-controlled content. If a victim accesses the affected functionality, that attacker-controlled content could be executed in the victim\ufffds browser, potentially resulting in session compromise. This could allow the attacker to execute arbitrary client-side code, impacting the confidentiality and integrity of the application, with no impact to availability.</p>"}]}], "references": [{"url": "https://me.sap.com/notes/3719397"}, {"url": "https://url.sap/sapsecuritypatchday"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 6.1, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-14T00:00:00+00:00", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-27674"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-15T03:58:11.103Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-27674", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-14T12:55:52.315231Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-14T13:09:20.842Z"}}], "cna": {"title": "Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java)", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.1, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP NetWeaver Application Server Java (Web Dynpro Java)", "versions": [{"status": "affected", "version": "WD-RUNTIME 7.50"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://me.sap.com/notes/3719397"}, {"url": "https://url.sap/sapsecuritypatchday"}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "Due to a Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java), an unauthenticated attacker could supply crafted input that is interpreted by the application and causes it to reference attacker-controlled content. If a victim accesses the affected functionality, that attacker-controlled content could be executed in the victim\ufffds browser, potentially resulting in session compromise. This could allow the attacker to execute arbitrary client-side code, impacting the confidentiality and integrity of the application, with no impact to availability.", "supportingMedia": [{"type": "text/html", "value": "<p>Due to a Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java), an unauthenticated attacker could supply crafted input that is interpreted by the application and causes it to reference attacker-controlled content. If a victim accesses the affected functionality, that attacker-controlled content could be executed in the victim\ufffds browser, potentially resulting in session compromise. This could allow the attacker to execute arbitrary client-side code, impacting the confidentiality and integrity of the application, with no impact to availability.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "eng", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-04-14T00:06:50.301Z"}}}, "cveMetadata": {"cveId": "CVE-2026-27674", "state": "PUBLISHED", "dateUpdated": "2026-04-15T03:58:11.103Z", "dateReserved": "2026-02-23T17:50:10.513Z", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "datePublished": "2026-04-14T00:06:50.301Z", "assignerShortName": "sap"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SAP NetWeaver Application Server Java (Web Dynpro Java)", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "WD-RUNTIME 7.50"}]}], "source": "cna@sap.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:sap:netweaver_application_server_java:7.50:*:*:*:*:*:*:*", "matchCriteriaId": "9C506445-3787-4BFF-A98B-7502A0F7CF80", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Due to a Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java), an unauthenticated attacker could supply crafted input that is interpreted by the application and causes it to reference attacker-controlled content. If a victim accesses the affected functionality, that attacker-controlled content could be executed in the victim\ufffds browser, potentially resulting in session compromise. This could allow the attacker to execute arbitrary client-side code, impacting the confidentiality and integrity of the application, with no impact to availability."}, {"lang": "es", "value": "Debido a una vulnerabilidad de inyecci\u00f3n de c\u00f3digo en SAP NetWeaver Servidor de aplicaciones Java (Web Dynpro Java), un atacante no autenticado podr\u00eda proporcionar una entrada manipulada que es interpretada por la aplicaci\u00f3n y hace que haga referencia a contenido controlado por el atacante. Si una v\u00edctima accede a la funcionalidad afectada, ese contenido controlado por el atacante podr\u00eda ejecutarse en el navegador de la v\u00edctima, lo que podr\u00eda resultar en el compromiso de la sesi\u00f3n. Esto podr\u00eda permitir al atacante ejecutar c\u00f3digo arbitrario del lado del cliente, impactando la confidencialidad y la integridad de la aplicaci\u00f3n, sin impacto en la disponibilidad."}], "id": "CVE-2026-27674", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "cna@sap.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-27674", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-14T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-04-14T00:16:05.670", "references": [{"source": "cna@sap.com", "tags": ["Permissions Required"], "url": "https://me.sap.com/notes/3719397"}, {"source": "cna@sap.com", "tags": ["Vendor Advisory"], "url": "https://url.sap/sapsecuritypatchday"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "cna@sap.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "WD-RUNTIME 7.50"}}], "enrichment": {"confidence": 80.0, "confidence_source": "matching", "scores": [{"score": 80.0, "source": "matching"}]}, "original": {"product": "SAP NetWeaver Application Server Java (Web Dynpro Java)", "source": "cna", "vendor": "SAP_SE"}, "product": "sap_netweaver_application_server_java", "vendor": "sap"}], "analysis": {"en": {"generated_at": "2026-04-14T01:51:30.574359+00:00", "value": {"mitigation_remediation": ["Apply the SAP security patch found in SAP Note 3719397", "Verify that the Web Dynpro Java component is updated to the patched version", "Refer to SAP Patch Day guidance to schedule maintenance for timely implementation"], "summary": {"action": "Immediate Patch", "impact": "Client-side code execution leading to session compromise"}, "threat_synthesis": {"affected_systems": "SAP NetWeaver Application Server Java, specifically the Web Dynpro Java module. No specific version numbers are disclosed, so all instances of this component should be reviewed for potential exposure.", "description_and_impact": "The vulnerability is a code injection flaw in SAP NetWeaver Application Server Java's Web Dynpro Java component. An unauthenticated attacker can send crafted input that the application interprets and renders as attacker-controlled content. When a user accesses the affected functionality, the injected content may run in the victim\u2019s browser, allowing arbitrary client-side code execution. This can compromise the confidentiality and integrity of the user session, but does not affect application availability.", "risk_and_exploitability": "The CVSS score of 6.1 indicates moderate severity. No publicly available exploit data or catalog listing is referenced. The vulnerability can be triggered by an unauthenticated user delivering malicious input and requires the victim to access the vulnerable functionality for the injected content to execute."}}}}, "created": "2026-04-14T16:16:32.240108+00:00", "updated": "2026-04-14T16:31:28.828023+00:00", "vendors": ["sap", "sap$PRODUCT$sap_netweaver_application_server_java"]}