{"affected":[{"defaultStatus":"unaffected","product":"SAP Web Dispatcher and Internet Communication Manager","source":"CNA: sap","vendor":"SAP_SE","versions":[{"status":"affected","version":"WEBDISP 7.93"},{"status":"affected","version":"9.16"},{"status":"affected","version":"XS_ADVANCED_RUNTIME 1.00"},{"status":"affected","version":"KERNEL 7.93"},{"status":"affected","version":"9.20"},{"status":"affected","version":"9.21"}]}],"cveId":"CVE-2026-120014","cwes":["CWE-352"],"description":"SAP HANA XSA Web Dispatcher does not perform sufficient request validation in certain administrative functionality. In the context of SAP HANA XSA Web Dispatcher, an unauthenticated attacker could trick a logged-on administrator into visiting a malicious link. Visiting the link could cause unintended actions in the administrator's session. Successful exploitation could lead to a temporary compromise of the SAP HANA XSA Web Dispatcher, resulting in a high impact on confidentiality, and partial impact on integrity, and availability.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.6,"severity":"high","source":"CNA: sap","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L","version":"3.1"}],"modifiedAt":1794271337181,"publishedAt":1794271337181,"references":[{"source":"CNA: sap","tags":[],"url":"https://me.sap.com/notes/3804858"},{"source":"CNA: sap","tags":[],"url":"https://url.sap/sapsecuritypatchday"}],"remediation":[],"revision":"f973ec55d6e45c5e44671a0ef56bf5869a885a7c82ff0b901d4c2f3700f68232","sources":[{"modifiedAt":1794271337181,"name":"CNA: sap","retrievedAt":1794272929947,"url":"https://www.cve.org/CVERecord?id=CVE-2026-120014"}],"ssvc":null,"status":"published","title":"Cross-Site Request Forgery (CSRF) vulnerability in SAP Web Dispatcher and Internet Communication Manager","updatedAt":1794272929947}