CVE-2026-40137: SAP TAF_APPLAUNCHER within Business Server Pages allows an unauthenticated attacker to craft malicious links that, when clicked by a victim, redirects them to…

PriorityP431medium6.1CVSS 3.1

AVNACLPRNUIRSCCLILAN

EPSS

0.21%

11.3th percentile

SAP TAF_APPLAUNCHER within Business Server Pages allows an unauthenticated attacker to craft malicious links that, when clicked by a victim, redirects them to attacker?controlled sites, potentially exposing or altering sensitive information in the victim�s browser. This results in a low impact on confidentiality and integrity, with no impact on the availability of the application.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
sap_se	business_server_pages_application	—	—
sap_se	business_server_pages_application	—	—

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.