XXE in SAP Se Integration Suite
CVE-2026-76958
SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity declarations. Successful exploitation could allow the attacker to read sensitive file contents from the server and expose them through monitoring or logging output, resulting in a high impact on confidentiality. It could also lead to resource exhaustion, causing a low impact on availability. There is no impact on integrity.
Vulnerability class: XXE (XML External Entity)
CVSS v3 metric
CVSS v3 base score 8.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L.
Affected products
- Sap_se Sap Integration Suite — versions B2BIntegrationFactoryCloudIntegrationTradingPartnerManagement 1.10.0, B2B Integration Factory - Cloud Integration - Trading Partner Management 1.10.0, CloudIntegrationTradingPartnerManagementV2 2.9.2
Weakness classification (CWE)
References
Frequently asked questions
- What is CVE-2026-76958?
- CVE-2026-76958 is a high-severity vulnerability in SAP Se Integration Suite, classified under Improper Restriction of XML External Entity Reference (XXE). CVSS score: 8.5/10. Published 2026-09-08.
- How severe is CVE-2026-76958?
- High severity. CVSS v3 base score is 8.5 out of 10.