Vulnerability · Published Jun 9, 2026 · Assigned by sap

CVE-2026-24315Path Traversal Vulnerability in SAP Fiori (launchpad)

Medium 4.2

In plain English

A medium-severity security flaw in SAP Fiori (launchpad) from SAP_SE. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 7% of all known vulnerabilities).

Severity (CVSS 3.1)4.2Medium

Exploit odds (30 days)0.2%top 93.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

SAP Fiori Launchpad allows attackers to craft malicious URLs that triggers arbitrary service calls on the Fiori domain, this when opened by the user could compromise accounts by stealing user credentials. Successful exploitation requires adversaries to possess advanced knowledge of the system causing low impact on Confidentiality and Integrity. Availability of the system is no impacted.

Affected products (as reported)

Vendor	Product	Versions
SAP_SE	SAP Fiori (launchpad)	SAP_UI 754755756757758816

Weakness: CWE-35 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

In plain English

Official description

Affected products (as reported)

References