CVE-2026-76974
Information Disclosure vulnerability in SAP Fiori Launchpad
CVSS Score
5.3
EPSS Score
0.0%
EPSS Percentile
0th
SAP Fiori Launchpad does not sufficiently validate certain user-controlled input. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated user, causes the browser to load attacker-controlled content from an external location. This could be used to exfiltrate sensitive information from the victim's session, resulting in a high impact on confidentiality. There is no impact on integrity and availability.
| Vendor | sap_se |
| Product | sap fiori launchpad |
| Published | Sep 22, 2026 |
Stay Ahead of the Next One
Get instant alerts for sap_se sap fiori launchpad
Be the first to know when new medium vulnerabilities affecting sap_se sap fiori launchpad are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
SAP_SE / SAP Fiori Launchpad
SAP_UI 757 758 816 SAP_BASIS 918