{"id":"CVE-2026-120016","kind":"vulnerability","aliases":["CVE-2026-120016"],"related":[],"title":"SAP NetWeaver Visual Composer: crafted link runs script in victim's browser","description":"SAP NetWeaver Visual Composer does not perform sufficient input validation and output encoding on certain request data. An unauthenticated attacker could craft a malicious link containing specially crafted input. If a victim clicks the link, the injected script executes in the victim's browser within the context of the affected application. This results in a low impact on confidentiality and integrity. There is no impact on availability.","summary":"SAP NetWeaver Visual Composer does not validate or encode certain request input, so a crafted link can inject script. When a victim opens the link, the script runs in their browser within the application's context, exposing limited data and integrity.","severity":"medium","cvss":6.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"SAP NetWeaver Visual Composer","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["java","netweaver","other","sap","visual-composer"],"not_affected_if":["unknown"],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-10T01:17:16+00:00","first_seen_at":"2026-11-10T01:26:39+00:00","triaged_at":"2026-11-10T01:28:54+00:00","updated_at":"2026-11-10T01:28:54+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-10T01:28:54Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"SAP NetWeaver Visual Composer: crafted link runs script in victim's browser","impact":"low","summary":"SAP NetWeaver Visual Composer does not validate or encode certain request input, so a crafted link can inject script. When a victim opens the link, the script runs in their browser within the application's context, exposing limited data and integrity.","audience":"businesses","category":"other","nicknames":[],"who_cares":["sap","netweaver","visual-composer","java"],"confidence":0.5,"fix_status":"unknown","needs_auth":"no","worst_case":"script runs in victim's browser within the application context","analyst_note":"Find SAP's security note for CVE-2026-120016 to confirm affected versions, fixed patch level and any mitigation; check https://nvd.nist.gov/vuln/detail/CVE-2026-120016.","how_to_check":"unknown","plain_action":"","product_name":"SAP NetWeaver Visual Composer","needs_analyst":true,"not_affected_if":["unknown"],"who_is_affected":"Organizations running SAP NetWeaver with the Visual Composer component are potentially exposed. Exploitation requires a victim to click a crafted link, and the sources do not say which Visual Composer versions or configurations are affected.","user_interaction":"yes","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000708,"input_tokens":4575,"output_tokens":501,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120016':15A,18A '-2026':14A,17A 'affect':120C 'applic':63B,121C 'attack':90C 'avail':137C 'browser':12A,60B,114C 'certain':39B,85C 'click':103C 'compos':4A,29B,33B,74C 'composer':22A 'confidenti':129C 'contain':96C 'context':65B,117C 'could':91C 'craft':5A,44B,92C,98C 'cve':13A,16A 'data':68B,87C 'encod':38B,83C 'execut':109C 'expos':66B 'impact':127C,135C 'inject':47B,107C 'input':41B,79C,99C 'integr':70B,131C 'java':23B 'limit':67B 'link':6A,45B,54B,95C,105C 'low':126C 'malici':94C 'netweav':2A,24B,31B,72C 'netweaver':20A 'open':52B 'output':82C 'perform':77C 'request':40B,86C 'result':123C 'run':7A,57B 'sap':1A,19A,26B,30B,71C 'script':8A,48B,56B,108C 'special':97C 'suffici':78C 'unauthent':89C 'valid':36B,80C 'victim':10A,51B,102C,112C 'visual':3A,21A,28B,32B,73C 'visual-compos':27B 'within':61B,115C","nicknames":[],"mitigations":[],"who_affected":"Organizations running SAP NetWeaver with the Visual Composer component are potentially exposed. Exploitation requires a victim to click a crafted link, and the sources do not say which Visual Composer versions or configurations are affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["netweavervisualcomposer","sapnetweavervisualcomposer"],"ptokens":["composer","netweaver","sap","visual"],"labels":["java","medium","netweaver","other","sap","vendor","visualcomposer"],"campaign_type":null,"search_a":"'-120016':15A,18A '-2026':14A,17A 'browser':12A 'compos':4A 'composer':22A 'craft':5A 'cve':13A,16A 'link':6A 'netweav':2A 'netweaver':20A 'run':7A 'sap':1A,19A 'script':8A 'victim':10A 'visual':3A,21A","search_b":"'applic':63B 'browser':60B 'certain':39B 'compos':29B,33B 'context':65B 'craft':44B 'data':68B 'encod':38B 'expos':66B 'inject':47B 'input':41B 'integr':70B 'java':23B 'limit':67B 'link':45B,54B 'netweav':24B,31B 'open':52B 'request':40B 'run':57B 'sap':26B,30B 'script':48B,56B 'valid':36B 'victim':51B 'visual':28B,32B 'visual-compos':27B 'within':61B","search_c":"'affect':120C 'applic':121C 'attack':90C 'avail':137C 'browser':114C 'certain':85C 'click':103C 'compos':74C 'confidenti':129C 'contain':96C 'context':117C 'could':91C 'craft':92C,98C 'data':87C 'encod':83C 'execut':109C 'impact':127C,135C 'inject':107C 'input':79C,99C 'integr':131C 'link':95C,105C 'low':126C 'malici':94C 'netweav':72C 'output':82C 'perform':77C 'request':86C 'result':123C 'sap':71C 'script':108C 'special':97C 'suffici':78C 'unauthent':89C 'valid':80C 'victim':102C,112C 'visual':73C 'within':115C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T01:17:16+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss_by":"cna@sap.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120016","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120016","severity":null,"published_at":"2026-11-10T01:17:16+00:00","modified_at":"2026-11-10T01:17:16+00:00","first_seen_at":"2026-11-10T01:26:39+00:00","fetched_at":"2026-11-10T01:26:39+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}