SAP NETWEAVER VISUAL COMPOSER · CVE-2026-120016 · Other
NO FIX YET
SAP NetWeaver Visual Composer does not validate or encode certain request input, so a crafted link can inject script. When a victim opens the link, the script runs in their browser within the application's context, exposing limited data and integrity.
first public Nov 10, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Organizations running SAP NetWeaver with the Visual Composer component are potentially exposed. Exploitation requires a victim to click a crafted link, and the sources do not say which Visual Composer versions or configurations are affected.
Not affected if unknown
Who cares java, netweaver, sap, visual-composer
Unknown from the sources.
No fix yet, per the sources.
SAP NetWeaver Visual Composer does not perform sufficient input validation and output encoding on certain request data. An unauthenticated attacker could craft a malicious link containing specially crafted input. If a victim clicks the link, the injected script executes in the victim's browser within the context of the affected application. This results in a low impact on confidentiality and integrity. There is no impact on availability.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.