CVE-2026-34257

MEDIUM

Open Redirect vulnerability in SAP NetWeaver Application Server ABAP

Title source: cna

Description

Due to an Open Redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft malicious URL that, if accessed by a victim, they could be redirected to the page controlled by the attacker. This causes low impact on confidentiality and integrity of the application with no impact on availability.

References (2)

https://me.sap.com/notes/3692004

https://url.sap/sapsecuritypatchday

Scores

CVSS v3 6.1

EPSS 0.0004

EPSS Percentile 11.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-601

Status published

Products (14)

SAP_SE/SAP NetWeaver Application Server ABAP SAP_BASIS 700

SAP_SE/SAP NetWeaver Application Server ABAP SAP_BASIS 701

SAP_SE/SAP NetWeaver Application Server ABAP SAP_BASIS 702

SAP_SE/SAP NetWeaver Application Server ABAP SAP_BASIS 731

SAP_SE/SAP NetWeaver Application Server ABAP SAP_BASIS 740

SAP_SE/SAP NetWeaver Application Server ABAP SAP_BASIS 750

SAP_SE/SAP NetWeaver Application Server ABAP SAP_BASIS 752

SAP_SE/SAP NetWeaver Application Server ABAP SAP_BASIS 753

SAP_SE/SAP NetWeaver Application Server ABAP SAP_BASIS 754

SAP_SE/SAP NetWeaver Application Server ABAP SAP_BASIS 755

... and 4 more

Published Apr 14, 2026

Tracked Since Apr 14, 2026