Visual Composer Reflected XSS: CVE-2026-120016 · CVSS 3.0 6.1 · SAP Note 3806484
Note 3806484 fixes reflected cross-site scripting in the SAP NetWeaver Visual Composer runtime. The application reflected request data into the page without proper encoding. As a result, a crafted link could run script in the victim’s browser within the application. SAP rates the Visual Composer Reflected XSS at CVSS 6.1, Medium. In this post, we cover exposure, the fix and what to check.
Visual Composer Reflected XSS: fix
This issue affects VC70RUNTIME 7.50. The correction encodes the reflected parameters. So deploy the support package patch from the note. Since Visual Composer runs on AS Java, the usual Java deployment steps apply.
Context
Visual Composer had a 9.9 access control HotNews in October (Note 3797111). Therefore, if you still use it, make sure both notes are in. In addition, consider whether you need the tool at all, since this is the second fix in two months.
How the attack works
The attacker sends a crafted link, for example by email or chat. When a logged-on user opens it, the script runs with that user’s session. Consequently, this attack can read data or trigger actions within the user’s own permissions.
What to check
First, find out whether anyone still uses Visual Composer. If nobody does, disable it. Otherwise, apply the patch, and remind users not to open SAP links from unknown senders. Finally, consider a content security policy at the Web Dispatcher, which limits this risk and similar bugs.
Visual Composer Reflected XSS: advisory details
Component: EP-VC-RTM
SAP priority: Medium
First release: 10.11.2026
Reviewed release: 10 November 2026, note version 4
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: SAP Security Note 3806484 (SAP for Me; sign-in needed). The patch and workaround details above reflect the version we reviewed on 10 November 2026. However, SAP sometimes updates notes after release, so check the current note before you plan.
Read the full SAP Security Patch Day November 2026 overview.
