CVE-2026-34257

Due to an Open Redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft malicious URL that, if accessed by a victim, they could be redirected to the page controlled by the attacker. This causes low impact on confidentiality and integrity of the application with no impact on availability.

Score

CVSS 3.1 6.1 Medium

Status

Analyzed - cna@sap.com

Published

2026-04-14

Last modified

2026-10-26

Weaknesses

CWE-601

Affected products

• Netweaver Application Server Abap (Sap)
• Sap Netweaver Application Server Abap (Sap Se)

References

• https://me.sap.com/notes/3692004
• https://url.sap/sapsecuritypatchday