CVE-2026-76972

What it is

Due to a Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later rendered by the application. If an authenticated victim accesses a page that displays this stored content, the injected input is processed during web page generation, resulting in the execution of malicious content in the victim�s browser context. This could allow the attacker to access or modify information within the victim�s browser scope. Successful exploitation could allow the attacker to access session information, modify rendered page content and disrupt the victim's use of the application, resulting in a low impact on confidentiality, integrity and availability.

At a glance

Exploitability

Can be exploited over the network with a low-privilege account, but needs a user to act. Limited direct impact.

Exploit odds

0.2% chance of exploitation in the next 30 days (EPSS).

Fix

No patch or advisory is linked yet. Look at mitigations or restrict exposure.

Timeline

1. 2026-10-13 01:16 UTC PublishedDisclosed publicly on CVE.org and NVD
2. 2026-10-15 20:38 UTC Last updatedMost recent change to the record

Details

Published

2026-10-13 01:16 UTC

Last modified

2026-10-15 20:38 UTC

Exploit probability

0.2% · EPSS, next 30 days

Weakness

CWE-79 · Cross-site scripting

Record status

Awaiting Analysis

Attack profile CVSS 3.1 · 6.5

Attack vector

Network

Complexity

Low

Privileges needed

Low

User interaction

Required

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low