---
id: "CVE-2026-109810"
page: "https://infrastack.ai/live/CVE-2026-109810"
kind: "vulnerability"
aliases: ["CVE-2026-109810"]
title: "SAP NetWeaver Java: crafted link injects styling, enabling phishing and content theft"
severity: "medium"
cvss: 6.1
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["java", "netweaver", "sap", "vendor", "web-dynpro-java"]
not_affected_if: ["no-netweaver-java"]
published_at: "2026-11-10T01:17:15+00:00"
first_seen_at: "2026-11-10T01:26:38+00:00"
updated_at: "2026-11-10T01:28:55+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109810", "first_seen_at": "2026-11-10T01:26:38+00:00"}]
exploit_sources: []
---

# SAP NetWeaver Java: crafted link injects styling, enabling phishing and content theft

Link for people: https://infrastack.ai/live/CVE-2026-109810 (this .md is for agents)

SAP NetWeaver Application Server Java (Web Dynpro Java) does not validate some request parameters used to resolve styling resources. A crafted link that an logged-in user clicks can load attacker-controlled styling in the trusted application, allowing UI redress for phishing and limited page content exfiltration.

_Summary, check and fix written by a model from the sources; labelled as such._

## Timeline

- 2026-11-10T01:26:38+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109810

## From the sources

SAP NetWeaver Application Server Java (Web Dynpro Java) does not sufficiently validate certain request parameters used to resolve styling resources in the application. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated victim, causes the victim's browser to load attacker-controlled styling content within the trusted application context. Successful exploitation could allow the attacker to redress the trusted user interface for phishing purposes and exfiltrate limited web page content, resulting in a low impact on confidentiality and integrity. There is no impact on availability.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_