EUVD-2026-84253
GHSA-454c-c45p-5rr9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCraft malicious Fiori Launchpad link
-
DeliveryDeliver link via phishing to authenticated user
-
ExploitVictim clicks, browser loads external content
-
ExecutionAttacker-controlled content reads session data
-
ImpactExfiltrate sensitive information to external location
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Eval input sanitization
MITRE ATT&CK
1 technique across 1 tactic: Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an authenticated SAP Fiori Launchpad user to click an attacker-crafted malicious link (UI:R); the attacker themselves needs no authentication (PR:N) but cannot succeed without victim interaction and an active victim session. The description's reliance on 'certain user-controlled input' that is insufficiently validated, combined with AC:H, indicates specific crafting conditions and a targeted delivery (e.g., phishing) rather than default-configuration remote exploitation. Limiting factors: the victim must be logged into Fiori Launchpad, must click the link, and must have sensitive data in-session; impact is confined to confidentiality (no integrity or availability effect). |
| Impact | This is a genuine but not top-priority issue. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N, base 5.3) shows a remote, unauthenticated attack that nonetheless carries two significant real-world dampeners: high attack complexity (AC:H) and required user interaction (UI:R). No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, so exploitation status is 'no public exploit identified at time of analysis.' The confidentiality-only impact is rated High (C:H) because session-sensitive data can be exfiltrated, but there is no integrity or availability impact. The signals are internally consistent: a high-CVSS-subscore for confidentiality tempered by AC:H + UI:R means this is not a mass-exploitable, wormable flaw but rather a targeted social-engineering vector requiring a specific victim (an authenticated Fiori user) to click a crafted link. Note one interpretive tension: the CWE is CWE-95 (Eval/Code Injection) and a tag reads 'Code Injection,' yet the description reads more like content/URL injection causing the browser to load external attacker content and exfiltrate session data - closer to client-side content injection than server-side eval - so treat the CWE-95 classification with caution and verify against SAP Note 3680888. |
| Exploit ScenarioDerived | An attacker crafts a malicious Fiori Launchpad link embedding unvalidated input and delivers it via phishing to an SAP user. When the authenticated victim clicks it, their browser loads attacker-controlled content from an external location, which harvests sensitive information from the victim's active session. No public exploit code is identified in the available data, and the attack depends on the victim being logged in and clicking the link. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 22, 2026
SAP Fiori Launchpad does not sufficiently validate certain user-controlled input, so an unauthenticated attacker can craft a malicious link that, once clicked by a logged-in user, makes the victim's browser pull attacker-controlled content from an external location and potentially expose data from the active session, producing a high confidentiality impact with no effect on integrity or availability. The issue is network-reachable (AV:N) but requires specific crafting conditions (AC:H) plus victim interaction (UI:R), while the attacker needs no credentials (PR:N); the assessed base score is 5.3 (Medium) on vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N. No public exploit code was identified at time of analysis, and the weakness class (CWE-95) points to injection into dynamically evaluated code rather than a default-configuration remote compromise, so the realistic risk is a targeted phishing-style data-theft attempt against authenticated launchpad users with sensitive in-session data.
RemediationAI
Apply the correction published by SAP for this issue; the designated fix is delivered through SAP Security Note 3680888 (https://me.sap.com/notes/3680888, SAP Support login required), released on the SAP Security Patch Day cycle documented at https://url.sap/sapsecuritypatchday, so administrators should import the note, confirm the applicable support package or note-level correction for their Fiori Launchpad back-end and front-end releases, and validate afterwards that the launchpad no longer loads external content from crafted links. Because the supplied data does not specify an exact patch level or fix version, no specific version number can be cited and the note's own implementation instructions must be followed. Where patching cannot be completed immediately, the most effective compensating control is a strict Content-Security-Policy on the launchpad host that pins script-src, frame-src/child-src and connect-src to trusted internal origins (trade-off: legitimate embedded third-party or external Fiori content may break and must be explicitly allowlisted); a reverse proxy or WAF rule that canonicalizes and rejects launchpad shell/intent parameters containing external URLs or script-like payloads can also block delivery of the malicious link (trade-off: false positives on valid cross-system intent navigation). Reduce what an attacker could exfiltrate by shortening idle session timeouts, requiring re-authentication for sensitive transactions, enforcing MFA, and restricting launchpad exposure to the internal network or VPN so the phishing link is harder to deliver to an authenticated session. Pair these with monitoring of proxy and browser egress logs for launchpad-originated requests to untrusted external domains, and with user awareness messaging about clicking unsolicited Fiori deep links; note that no public exploit code was identified at time of analysis, so the immediate priority is note-driven patching rather than emergency containment.
Affected VersionsENISA
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
SAP Fiori Launchpad is the browser-based entry shell for SAPUI5/Fiori applications, assembled largely from client-side JavaScript with hash-based routing, intent-based navigation, shell parameters and tile/plugin configuration that are influenced by URL input. CWE-95 ('Eval Injection') indicates that some of that user-controlled input is passed into a dynamically evaluated code path (for example an eval-like construct or a dynamic loader that builds a URL or code fragment) without neutralization of the directives it contains. Because the affected component runs inside the victim's authenticated browser context, a crafted link that reaches that code path can redirect the launchpad to load content from an attacker-controlled external origin, and same-origin/credential-bearing requests or DOM data from the session can then be leaked. The CPE cpe:2.3:a:sap_se:sap_fiori_launchpad:* is fully wildcarded, meaning the vendor-facing scope covers the Fiori Launchpad component generally rather than a single fixed release, so applicability must be confirmed against the installed front-end/ABAP (or corresponding hosted) release per SAP's note. The assessed vector's AC:H and UI:R reflect that the attacker cannot trigger this directly: a link must be delivered to a logged-in user, the correct shell parameters must be crafted for the target configuration, and the user must click it, which is consistent with a narrowly crafted, socially engineered attack rather than a generic exploit.
Know when Sap Fiori Launchpad gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Remote unauthenticated attacker (AV:N/PR:N) but needs victim click and specific crafted input (UI:R/AC:H); confidentiality-only session data exposure (C:H, I:N/A:N), no scope change.
Primary rating from Vendor (sap).
CVSS VectorVendor: sap
DescriptionCVE.org
SAP Fiori Launchpad does not sufficiently validate certain user-controlled input. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated user, causes the browser to load attacker-controlled content from an external location. This could be used to exfiltrate sensitive information from the victim's session, resulting in a high impact on confidentiality. There is no impact on integrity and availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Code injection occurs when an application accepts user input and passes it directly into a language interpreter or evaluator without proper sanitization.
Exploit-DB