CVE-2026-44768CWE-15

Security misconfiguration in SAP CRM (WebClient UI)

Medium · published July 14, 2026

CVSS v3.1
4.1
EPSS
0%
Percentile
16.6
In the wild
Unconfirmed
What it is

SAP CRM WebClient UI allows an attacker to inject and execute malicious scripts in the context of the application due to the absence of a Content Security Policy (CSP) configuration for certain restrictive directives. This vulnerability has a low impact on the integrity of the application. Confidentiality and availability are not impacted.

The record
Technical detail
CVSS v3.1
4.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00259 · 16.6th percentile
Weakness
CWE-15 · External Control of System or Configuration Setting
Published
2026-07-14T00:20Z
EPSS history
Timeline
  • 14 JUL 00:20Z
    Security misconfiguration in SAP CRM (WebClient UI)
    cvelistv5