Web Dynpro Java CSS Injection: CVE-2026-109810 · CVSS 3.0 6.1 · SAP Note 3797108
Note 3797108 fixes how SAP NetWeaver AS Java (Web Dynpro Java) resolves styling resources from request parameters. An attacker could craft a link that makes the victim’s browser load attacker-controlled CSS inside the trusted application. That is enough to redress the UI for phishing and to leak limited page content. SAP rates the Web Dynpro Java CSS Injection at CVSS 6.1, Medium. In this post, we cover exposure, the fix and what to check.
Web Dynpro Java CSS Injection: behaviour change
The Web Dynpro Java CSS Injection fix covers WD-RUNTIME 7.50. After the patch, the runtime loads theme resources only from permitted hosts. If you configure none, the runtime allows only the current host. So if you serve themes from a separate host, maintain those hosts in the theme hosts configuration before rollout. The same applies to the UI theme designer on another system.
Compatibility switch
In addition, SAP adds the property themehostsProtection. Setting it to false restores the old behaviour. However, that also brings back this issue, so SAP recommends an explicit allowlist instead. We agree.
How the attack works
Typically, the attacker sends a link with a crafted theme parameter. When the victim opens it, the page looks normal but uses the attacker’s styles. For example, the attacker can hide real fields and show fake ones. In this way, the Web Dynpro Java CSS Injection supports convincing phishing inside a trusted URL.
What to check
First, find out where your Web Dynpro Java themes come from. Next, add those hosts to the allowlist in a test system and apply the patch. Finally, check that custom themes still load before you move to production, so the Web Dynpro Java CSS Injection fix does not break the UI.
Web Dynpro Java CSS Injection: advisory details
Component: BC-WD-JAV
SAP priority: Medium
First release: 10.11.2026
Reviewed release: 10 November 2026, note version 1
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: SAP Security Note 3797108 (SAP for Me; sign-in needed). The patch and workaround details above reflect the version we reviewed on 10 November 2026. However, SAP sometimes updates notes after release, so check the current note before you plan.
Read the full SAP Security Patch Day November 2026 overview.
