CVE-2026-24328

SAP TAF_APPLAUNCHER within Business Server Pages allows unauthenticated attacker to craft malicious links that, when clicked by a victim, redirect them to attacker?controlled sites, potentially exposing or altering sensitive information in the victim�s browser. This results in a low impact on confidentiality and integrity, with no impact on the availability of the application.

Score

CVSS 3.1 6.1 Medium

Status

Analyzed - cna@sap.com

Published

2026-02-10

Last modified

2026-02-10

Weaknesses

CWE-601

Affected products

• Business Server Pages (Sap)
• Business Server Pages Application Taf Applauncher (Sap Se)

References

• https://me.sap.com/notes/3688319
• https://url.sap/sapsecuritypatchday