medium2026-06-09SAP Solution ManagerCVE-2026-44757
XSS via URL Parameter Encoding in SAP Wily Introscope Enterprise Manager
SAP Wily Introscope Enterprise Manager
Our Take
Wily Introscope is an APM tool used primarily by BASIS and development teams — limited attack surface. Medium severity and narrow audience. Include in your next Solution Manager maintenance cycle.
Vulnerability Detail
Cross-site scripting vulnerability in SAP Wily Introscope Enterprise Manager triggered via malicious URL parameter encoding. An attacker who can trick an authenticated user into visiting a crafted URL can execute scripts in the victim's browser context within the Introscope management console.
Patch Action
Apply SAP Note 3715280.
Affected Versions
SEM-WLY — see SAP Note for specific Introscope versions
Patch Info