CVE-2026-24315

MediumCVSS 4.2

Published: 09/06/2026(UTC)Updated: 23/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

7th percentile - higher than 7% of all known CVEs

Summary

SAP Fiori Launchpad allows attackers to craft malicious URLs that trigger arbitrary service calls on the Fiori domain. When opened by the user, this could compromise accounts by stealing user credentials. Successful exploitation requires advanced system knowledge, with low impact on confidentiality and integrity. System availability is not affected.

Risk Assessment

An attacker can steal user credentials via malicious links, potentially leading to unauthorized access to the SAP system.

Recommendation

Apply patches provided by SAP for SAP Fiori Launchpad and educate users to be cautious when clicking links.

Other vulnerabilities in SAP Fiori Launchpad

CVE-2026-76974Medium
SAP Fiori Launchpad does not sufficiently validate certain user-controlled input. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated user, causes the browser to load attacker-controlled content from an external location. This could be used to exfiltrate sensitive information from the victim's session, resulting in a high impact on confidentiality, with no impact on integrity and availability.

Original NVD description (English source)

SAP Fiori Launchpad allows attackers to craft malicious URLs that triggers arbitrary service calls on the Fiori domain, this when opened by the user could compromise accounts by stealing user credentials. Successful exploitation requires adversaries to possess advanced knowledge of the system causing low impact on Confidentiality and Integrity. Availability of the system is no impacted.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS