CVE-2026-40137

SAP TAF_APPLAUNCHER within Business Server Pages allows an unauthenticated attacker to craft malicious links that, when clicked by a victim, redirects them to attacker?controlled sites, potentially exposing or altering sensitive information in the victim�s browser. This results in a low impact on confidentiality and integrity, with no impact on the availability of the application.

Score

CVSS 3.1 6.1 Medium

Status

Awaiting Analysis - cna@sap.com

Published

2026-05-12

Last modified

2026-10-26

Weaknesses

CWE-79

Affected products

• Business Server Pages Application Taf Applauncher (Sap Se)

References

• https://me.sap.com/notes/3727717
• https://url.sap/sapsecuritypatchday