CVE-2026-109810

SAP NetWeaver Application Server Java (Web Dynpro Java) does not sufficiently validate certain request parameters used to resolve styling resources in the application. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated victim, causes the victim's browser to load attacker-controlled styling content within the trusted application context. Successful exploitation could allow the attacker to redress the trusted user interface for phishing purposes and exfiltrate limited web page content, resulting in a low impact on confidentiality and integrity. There is no impact on availability.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

• https://me.sap.com/notes/3797108
• https://url.sap/sapsecuritypatchday