CVE-2026-24315: SAP Fiori Launchpad allows attackers to craft malicious URLs that triggers arbitrary service calls on the Fiori domain, this when opened by the user could…

PriorityP423medium4.2CVSS 3.1

AVNACHPRNUIRSUCLILAN

EPSS

0.17%

7.1th percentile

SAP Fiori Launchpad allows attackers to craft malicious URLs that triggers arbitrary service calls on the Fiori domain, this when opened by the user could compromise accounts by stealing user credentials. Successful exploitation requires adversaries to possess advanced knowledge of the system causing low impact on Confidentiality and Integrity. Availability of the system is no impacted.

Affected

6 ranges

Vendor	Product	Version range	Fixed in
sap_se	sap_fiori	—	—
sap_se	sap_fiori	—	—
sap_se	sap_fiori	—	—
sap_se	sap_fiori	—	—
sap_se	sap_fiori	—	—
sap_se	sap_fiori	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.