CVE-2025-26662 - CVE House

Back to Database

Status published Medium CVE-2025-26662

Cross-Site Scripting (XSS) vulnerability in the SAP Data Services Management Console

4.4 CVSS

Vulnerability Description

The Data Services Management Console does not sufficiently encode user-controlled inputs, allowing an attacker to inject malicious script. When a targeted victim, who is already logged in, clicks on the compromised link, the injected script gets executed within the scope of victim�s browser. This potentially leads to an impact on confidentiality and integrity. Availability is not impacted.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-26662

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from SAP_SE

View All →

Missing Authorization Check in SAP Landscape Transformation (PCL Basis)

Code injection vulnerability in SAP S/4HANA Cloud Private Edition or On Premise(SCM Master Data Layer (MDL))

Missing Authorization check in SAP Service Parts Management (SPM)

Missing Authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal

Missing Authorization check in SAP Service Parts Management (SPM)

Affected Vendor

SAP_SE

View all reports →

Affected Software

SAP Data Services Management Console

Vulnerable Versions:

SBOP DS JOB SERVER 4.3

Timeline

Official Publish: May 13th, 2025

Last Modified: November 7th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1189 Drive-by Compromise

T1059.007 JavaScript

T1539 Steal Web Session Cookie

T1213 Data from Information Repositories

T1567 Exfiltration Over Web Service

T1491.001 Defacement