medium2026-06-09SAP NetWeaverCVE-2026-44746
Reflected XSS in SAP NetWeaver AS Java JDBC Test Servlet
SAP NetWeaver Application Server Java (BW Business Explorer JDBC Test Servlet)
Our Take
JDBC Test Servlets should never be exposed to untrusted networks. If you run NetWeaver AS Java, verify this endpoint is not reachable from the internet or intranet broadly, then patch in the next window.
Vulnerability Detail
Reflected cross-site scripting vulnerability in the JDBC Test Servlet of the BW Business Explorer component in SAP NetWeaver AS Java. An attacker can craft a malicious URL that, when visited by an authenticated user, executes scripts in the victim's browser context — enabling session hijacking, phishing, or credential theft.
Patch Action
Apply SAP Note 3723655. Verify affected versions in the official SAP Note.
Patch Info