CVE-2026-24315

MediumCVSS 4.2

Published: 09/06/2026(UTC)Updated: 09/06/2026(UTC)Translated: 10/06/2026(UTC)NVD NIST

Summary

SAP Fiori Launchpad allows attackers to craft malicious URLs that triggers arbitrary service calls on the Fiori domain. When opened by the user, this could compromise accounts by stealing user credentials.

Risk Assessment

Successful exploitation requires adversaries to possess advanced knowledge of the system, causing low impact on Confidentiality and Integrity. Availability of the system is not impacted.

Recommendation

It is recommended to monitor and restrict access to Fiori Launchpad and educate users about potential threats associated with opening unknown links.

Original NVD description (English source)

SAP Fiori Launchpad allows attackers to craft malicious URLs that triggers arbitrary service calls on the Fiori domain, this when opened by the user could compromise accounts by stealing user credentials. Successful exploitation requires adversaries to possess advanced knowledge of the system causing low impact on Confidentiality and Integrity. Availability of the system is no impacted.