CVE-2026-76976 · CVSS 3.0 5.4 · SAP Note 3671819
The correction for CVE-2026-76976 can change how legitimate HTML content renders. SAP tightens sanitization in applications based on SAP GUI for HTML, including removal of certain URI schemes from src and href attributes. Teams that use inline data URLs should test those pages before rollout.
How a user becomes exposed
An authenticated attacker must place malicious content on the ABAP application server. Another user must then interact with that content for script to execute in their browser context. SAP gives the issue CVSS 5.4 and Medium priority, with low confidentiality and integrity impacts and no availability impact.
Affected components and deployment
The note lists SAP_BASIS 731, 740 and the 750–816 range. Implement the correction instructions and applicable prerequisites, or the support package for the installed release. SAP states that no configuration changes are required. Record the note implementation result rather than treating a front-end browser update as the SAP correction.
Rendering changes to expect
The corrected sanitizer removes affected attributes using schemes such as data:, blob:, file:, mhtml: and filesystem:. SAP specifically warns that legitimate inline base64 images using data URLs will stop rendering and need server-hosted replacements. Empty style and script elements are also emitted with explicit closing tags. Include HTML viewer pages, business messages and embedded images in functional checks. If content disappears after the patch, investigate these documented changes before assuming the patch installation failed.
Advisory details
Component: BC-FES-CTL
SAP priority: Correction with medium priority
First release: 13.10.2026
Reviewed release: 13 October 2026, note version 4
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: SAP Security Note 3671819 (SAP for Me; sign-in may be required). The patch and workaround details above reflect the version reviewed on 13 October 2026. Check the current note for subsequent changes.
