CVE-2026-76972 · CVSS 3.0 6.5 · SAP Note 3798823
SAP’s response to CVE-2026-76972 is a set of controls for dashboard authoring and publication. Note 3798823 is a consulting note: its solution calls for tighter author permissions, review of SSCE content, controlled transports and Content Security Policy. It should not be closed merely because a software patch was installed.
Stored content reaches a second user
Insufficient output encoding allows malicious dashboard content to be stored and later rendered in an authenticated user’s browser. SAP describes possible access to session information, alteration of page content and disruption of the user’s session. The score is 6.5, Medium priority, with low confidentiality, integrity and availability impacts. XMII 15.4 and 15.5 are listed.
Restrict who can publish dashboard content
SAP directs customers to limit XMII_SSCE_CHANGE and XMII_SSCE_ALL to users who need authoring access. These actions are included by default in several broad MII administration and development roles. The solution also calls for version control, administrator approval before production publication and NWDI transports instead of direct production editing. Review external destinations in scripts, links, frames and form actions as part of that approval.
CSP needs explicit configuration
SAP recommends configuring Content Security Policy in MII System Administration to restrict script execution and outbound connections, referring to Note 3567906. CSP is not enabled by default. Test real dashboards after introducing the policy and document necessary destinations. Evidence for this remediation should include role assignments, the production publishing process and the effective CSP configuration.
Advisory details
Component: MFG-MII
SAP priority: Correction with medium priority
First release: 13.10.2026
Reviewed release: 13 October 2026, note version 8
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
Source: SAP Security Note 3798823 (SAP for Me; sign-in may be required). The patch and workaround details above reflect the version reviewed on 13 October 2026. Check the current note for subsequent changes.
