SAP SE SAP Fiori Launchpad vulnerabilities

3 CVEs affecting SAP SE SAP Fiori Launchpad, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-76974, published 2026-09-22.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-76974, published 2026-09-22. Medium severity, CVSS 5.3. EPSS: 0.3% chance of exploitation in the next 30 days. SAP Fiori Launchpad does not sufficiently validate certain user-controlled input. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated user, causes the…
CVE-2025-42941, published 2025-08-12. Low severity, CVSS 3.5. EPSS: 0.2% chance of exploitation in the next 30 days. SAP Fiori (Launchpad) is vulnerable to Reverse Tabnabbing vulnerability due to inadequate external navigation protections for its link (<a>) elements. An attacker with administrative user privileges…
CVE-2026-24315, published 2026-06-09. Medium severity, CVSS 4.2. EPSS: 0.2% chance of exploitation in the next 30 days. SAP Fiori Launchpad allows attackers to craft malicious URLs that triggers arbitrary service calls on the Fiori domain, this when opened by the user could compromise accounts by stealing user…