CVE-2026-27680: CSS Injection vulnerability in SAP NetWeaver Application Server ABAP
Due to improper input handling under certain conditions, SAP NetWeaver Application Server ABAP allows an attacker to inject custom Cascading Style Sheets (CSS) data into a web page served by the application. When a user accesses or clicks the affected page, the injected CSS is executed. As a result, the issue has a low impact on confidentiality, while integrity and availability are not impacted.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-27680?
CVE-2026-27680 is considered a medium severity vulnerability due to its potential impact on user experience and website integrity.
How do I fix CVE-2026-27680?
To fix CVE-2026-27680, ensure proper input validation and sanitization for CSS input in your SAP NetWeaver Application Server ABAP environment.
What systems are affected by CVE-2026-27680?
CVE-2026-27680 affects the SAP NetWeaver Application Server ABAP due to improper input handling.
What potential risks are associated with CVE-2026-27680?
The risks associated with CVE-2026-27680 include unauthorized style manipulation leading to phishing attacks or website defacement.
How can I prevent CVE-2026-27680 from being exploited?
Prevent CVE-2026-27680 exploitation by implementing strict input validation and regularly updating your SAP NetWeaver Application Server ABAP software.