CVE-2026-44757

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44757", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "state": "PUBLISHED", "assignerShortName": "sap", "dateReserved": "2026-05-07T18:31:04.067Z", "datePublished": "2026-06-09T00:21:50.279Z", "dateUpdated": "2026-06-09T14:32:19.332Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-06-09T00:21:50.279Z"}, "title": "Cross-Site Scripting (XSS) vulnerability in SAP Wily Introscope Enterprise Manager", "problemTypes": [{"descriptions": [{"lang": "eng", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation", "type": "CWE"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP Wily Introscope Enterprise Manager", "versions": [{"status": "affected", "version": "WILY_INTRO_ENTERPRISE 10.8"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "SAP Wily Introscope Enterprise Manager allows an unauthenticated attacker to craft a specially crafted URL. Under certain conditions, when accessed by a victim, the injected script could execute in the user\ufffds browser within the context of the application. This issue has a low impact on the confidentiality and integrity of the application with no impact on availability.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>SAP Wily Introscope Enterprise Manager allows an unauthenticated attacker to craft a specially crafted URL. Under certain conditions, when accessed by a victim, the injected script could execute in the user\ufffds browser within the context of the application. This issue has a low impact on the confidentiality and integrity of the application with no impact on availability.</p>"}]}], "references": [{"url": "https://me.sap.com/notes/3715280"}, {"url": "https://url.sap/sapsecuritypatchday"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 4.7, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"}}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-09T14:32:11.478229Z", "id": "CVE-2026-44757", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-09T14:32:19.332Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44757", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-09T14:32:11.478229Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-09T14:32:15.833Z"}}], "cna": {"title": "Cross-Site Scripting (XSS) vulnerability in SAP Wily Introscope Enterprise Manager", "source": {"discovery": "UNKNOWN"}, "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "SAP_SE", "product": "SAP Wily Introscope Enterprise Manager", "versions": [{"status": "affected", "version": "WILY_INTRO_ENTERPRISE 10.8"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://me.sap.com/notes/3715280"}, {"url": "https://url.sap/sapsecuritypatchday"}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "SAP Wily Introscope Enterprise Manager allows an unauthenticated attacker to craft a specially crafted URL. Under certain conditions, when accessed by a victim, the injected script could execute in the user\ufffds browser within the context of the application. This issue has a low impact on the confidentiality and integrity of the application with no impact on availability.", "supportingMedia": [{"type": "text/html", "value": "<p>SAP Wily Introscope Enterprise Manager allows an unauthenticated attacker to craft a specially crafted URL. Under certain conditions, when accessed by a victim, the injected script could execute in the user\ufffds browser within the context of the application. This issue has a low impact on the confidentiality and integrity of the application with no impact on availability.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "eng", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation"}]}], "providerMetadata": {"orgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "shortName": "sap", "dateUpdated": "2026-06-09T00:21:50.279Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44757", "state": "PUBLISHED", "dateUpdated": "2026-06-09T14:32:19.332Z", "dateReserved": "2026-05-07T18:31:04.067Z", "assignerOrgId": "e4686d1a-f260-4930-ac4c-2f5c992778dd", "datePublished": "2026-06-09T00:21:50.279Z", "assignerShortName": "sap"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SAP Wily Introscope Enterprise Manager", "vendor": "SAP_SE", "versions": [{"status": "affected", "version": "WILY_INTRO_ENTERPRISE 10.8"}]}], "source": "cna@sap.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SAP Wily Introscope Enterprise Manager allows an unauthenticated attacker to craft a specially crafted URL. Under certain conditions, when accessed by a victim, the injected script could execute in the user\ufffds browser within the context of the application. This issue has a low impact on the confidentiality and integrity of the application with no impact on availability."}, {"lang": "es", "value": "SAP Wily Introscope Enterprise Manager permite a un atacante no autenticado crear una URL especialmente dise\u00f1ada. Bajo ciertas condiciones, cuando es accedido por una v\u00edctima, el script inyectado podr\u00eda ejecutarse en el navegador del usuario dentro del contexto de la aplicaci\u00f3n. Este problema tiene un bajo impacto en la confidencialidad e integridad de la aplicaci\u00f3n, sin impacto en la disponibilidad."}], "id": "CVE-2026-44757", "lastModified": "2026-07-23T08:10:00.137", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 2.7, "source": "cna@sap.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44757", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-09T14:32:11.478229Z", "version": "2.0.3"}}]}, "published": "2026-06-09T01:16:47.337", "references": [{"source": "cna@sap.com", "url": "https://me.sap.com/notes/3715280"}, {"source": "cna@sap.com", "url": "https://url.sap/sapsecuritypatchday"}], "sourceIdentifier": "cna@sap.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "cna@sap.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "WILY_INTRO_ENTERPRISE 10.8"}}], "enrichment": {"confidence": 85.0, "confidence_source": "matching", "scores": [{"score": 85.0, "source": "matching"}]}, "original": {"product": "SAP Wily Introscope Enterprise Manager", "source": "cna", "vendor": "SAP_SE"}, "product": "introscope_enterprise_manager", "vendor": "sap"}], "created": "2026-06-09T02:30:26.518443+00:00", "updated": "2026-06-09T08:00:14.050915+00:00", "vendors": ["sap", "sap$PRODUCT$introscope_enterprise_manager"]}