{"id":"CVE-2026-109810","kind":"vulnerability","aliases":["CVE-2026-109810"],"related":[],"title":"SAP NetWeaver Java: crafted link injects styling, enabling phishing and content theft","description":"SAP NetWeaver Application Server Java (Web Dynpro Java) does not sufficiently validate certain request parameters used to resolve styling resources in the application. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated victim, causes the victim's browser to load attacker-controlled styling content within the trusted application context. Successful exploitation could allow the attacker to redress the trusted user interface for phishing purposes and exfiltrate limited web page content, resulting in a low impact on confidentiality and integrity. There is no impact on availability.","summary":"SAP NetWeaver Application Server Java (Web Dynpro Java) does not validate some request parameters used to resolve styling resources. A crafted link that an logged-in user clicks can load attacker-controlled styling in the trusted application, allowing UI redress for phishing and limited page content exfiltration.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["java","netweaver","sap","vendor","web-dynpro-java"],"not_affected_if":["no-netweaver-java"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T01:17:15+00:00","first_seen_at":"2026-11-10T01:26:38+00:00","triaged_at":"2026-11-10T01:28:55+00:00","updated_at":"2026-11-10T01:28:55+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-10T01:28:55Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"SAP NetWeaver Java: crafted link injects styling, enabling phishing and content theft","impact":"low","summary":"SAP NetWeaver Application Server Java (Web Dynpro Java) does not validate some request parameters used to resolve styling resources. A crafted link that an logged-in user clicks can load attacker-controlled styling in the trusted application, allowing UI redress for phishing and limited page content exfiltration.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["sap","netweaver","web-dynpro-java","java"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Phishing via redressed UI and limited page content leaks","analyst_note":"Check the SAP Security Note and affected release list for CVE-2026-109810; the NVD entry does not give affected or fixed versions.","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-netweaver-java"],"who_is_affected":"Organisations running SAP NetWeaver Application Server Java with the Web Dynpro Java component. Exposure requires a logged-in user to click a crafted link; the sources do not name affected SAP releases or the default configuration.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000707,"input_tokens":4645,"output_tokens":485,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-109810':15A,18A '-2026':14A,17A 'allow':66B,134C 'applic':29B,65B,78C,98C,129C 'attack':59B,101C,122C,136C 'attacker-control':58B,121C 'authent':112C 'avail':166C 'browser':118C 'caus':114C 'certain':88C 'click':55B,109C 'confidenti':158C 'content':11A,74B,125C,151C 'context':130C 'control':60B,123C 'could':102C,133C 'craft':4A,47B,103C 'cve':13A,16A 'dynpro':25B,33B,82C 'enabl':8A 'exfiltr':75B,147C 'exploit':132C 'impact':156C,164C 'inject':6A 'integr':160C 'interfac':142C 'java':3A,19B,26B,31B,34B,80C,83C 'limit':72B,148C 'link':5A,48B,106C 'load':57B,120C 'log':52B 'logged-in':51B 'low':155C 'malici':105C 'netweav':2A,20B,28B,77C 'page':73B,150C 'paramet':40B,90C 'phish':9A,70B,144C 'purpos':145C 'redress':68B,138C 'request':39B,89C 'resolv':43B,93C 'resourc':45B,95C 'result':152C 'sap':1A,21B,27B,76C 'server':30B,79C 'style':7A,44B,61B,94C,124C 'success':131C 'suffici':86C 'theft':12A 'trust':64B,128C,140C 'ui':67B 'unauthent':100C 'use':41B,91C 'user':54B,141C 'valid':37B,87C 'vendor':22B 'victim':113C,116C 'web':24B,32B,81C,149C 'web-dynpro-java':23B 'within':126C","nicknames":[],"mitigations":[],"who_affected":"Organisations running SAP NetWeaver Application Server Java with the Web Dynpro Java component. Exposure requires a logged-in user to click a crafted link; the sources do not name affected SAP releases or the default configuration.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["java","medium","netweaver","sap","vendor","webdynprojava"],"campaign_type":null,"search_a":"'-109810':15A,18A '-2026':14A,17A 'content':11A 'craft':4A 'cve':13A,16A 'enabl':8A 'inject':6A 'java':3A 'link':5A 'netweav':2A 'phish':9A 'sap':1A 'style':7A 'theft':12A","search_b":"'allow':66B 'applic':29B,65B 'attack':59B 'attacker-control':58B 'click':55B 'content':74B 'control':60B 'craft':47B 'dynpro':25B,33B 'exfiltr':75B 'java':19B,26B,31B,34B 'limit':72B 'link':48B 'load':57B 'log':52B 'logged-in':51B 'netweav':20B,28B 'page':73B 'paramet':40B 'phish':70B 'redress':68B 'request':39B 'resolv':43B 'resourc':45B 'sap':21B,27B 'server':30B 'style':44B,61B 'trust':64B 'ui':67B 'use':41B 'user':54B 'valid':37B 'vendor':22B 'web':24B,32B 'web-dynpro-java':23B","search_c":"'allow':134C 'applic':78C,98C,129C 'attack':101C,122C,136C 'attacker-control':121C 'authent':112C 'avail':166C 'browser':118C 'caus':114C 'certain':88C 'click':109C 'confidenti':158C 'content':125C,151C 'context':130C 'control':123C 'could':102C,133C 'craft':103C 'dynpro':82C 'exfiltr':147C 'exploit':132C 'impact':156C,164C 'integr':160C 'interfac':142C 'java':80C,83C 'limit':148C 'link':106C 'load':120C 'low':155C 'malici':105C 'netweav':77C 'page':150C 'paramet':90C 'phish':144C 'purpos':145C 'redress':138C 'request':89C 'resolv':93C 'resourc':95C 'result':152C 'sap':76C 'server':79C 'style':94C,124C 'success':131C 'suffici':86C 'trust':128C,140C 'unauthent':100C 'use':91C 'user':141C 'valid':87C 'victim':113C,116C 'web':81C,149C 'within':126C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:15+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"cna@sap.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109810","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109810","severity":null,"published_at":"2026-11-10T01:17:15+00:00","modified_at":"2026-11-10T01:17:15+00:00","first_seen_at":"2026-11-10T01:26:38+00:00","fetched_at":"2026-11-10T01:26:38+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}