Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java)

The primary impact of CVE-2026-27674 is the potential for session compromise and the execution of arbitrary client-side code within a victim's browser. An attacker could craft malicious input that, when accessed by a user interacting with the vulnerable Web Dynpro Java functionality, would trigger the execution of the attacker's code. This could enable the attacker to steal session cookies, impersonate the user, and gain unauthorized access to sensitive data or functionality within the SAP NetWeaver environment. The lack of authentication required for exploitation significantly broadens the attack surface, making it accessible to a wide range of threat actors. While the description doesn't explicitly mention lateral movement, a compromised session could be leveraged to access other resources within the SAP environment, depending on the user's privileges and the application's configuration.

Organizations heavily reliant on SAP NetWeaver Application Server Java (Web Dynpro Java) for critical business processes are at significant risk. Specifically, deployments using the affected version 7.50–WD-RUNTIME 7.50 are immediately vulnerable. Environments with weak input validation practices or lacking WAF protection are particularly susceptible to exploitation.

• java / server:

# Check for suspicious user input handling in Web Dynpro Java code
grep -r 'userInput.toString()' /path/to/application/code

• generic web:

# Monitor access logs for unusual requests containing potentially malicious input
 grep -i 'script' /var/log/apache2/access.log

1. 2026-04-14Disclosure

   disclosure

1. Reserviert2026-02-23
2. Veröffentlicht2026-04-14
3. Geändert2026-04-15
4. EPSS aktualisiert2026-04-21

The primary mitigation for CVE-2026-27674 is to upgrade to a patched version of SAP NetWeaver Application Server Java (Web Dynpro Java) as soon as it becomes available. SAP has not yet released a fixed version as of the publication date. In the interim, consider implementing input validation and sanitization techniques within the Web Dynpro Java application to prevent the injection of malicious code. Web Application Firewalls (WAFs) configured to detect and block suspicious input patterns could also provide a layer of defense. Review and restrict access to the vulnerable Web Dynpro Java functionality to minimize the potential impact of a successful attack.