CVE-2026-76974
SAP Fiori Launchpad does not sufficiently validate certain user-controlled input. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated user, causes the browser to load attacker-controlled content from an external location. This could be used to exfiltrate sensitive information from the victim's session, resulting in a high impact on confidentiality. There is no impact on integrity and availability.
- Score
- CVSS 3.1 5.3 Medium
- Status
- Awaiting Analysis - cna@sap.com
- Published
- 2026-09-22
- Last modified
- 2026-09-22
- Weaknesses
- CWE-95
Affected products
References
- https://me.sap.com/notes/3680888
- https://url.sap/sapsecuritypatchday
