CVE-2026-76974: SAP SE SAP Fiori Launchpad

Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days.

SAP Fiori Launchpad does not sufficiently validate certain user-controlled input. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated user, causes the browser to load attacker-controlled content from an external location. This could be used to exfiltrate sensitive information from the victim's session, resulting in a high impact on confidentiality. There is no impact on integrity and availability.

Affected products

• SAP SE SAP Fiori Launchpad: version 758 only; version 816 only

Published 2026-09-22. Last modified 2026-09-22.