Server-Side Request Forgery Vulnerability in SAP NetWeaver Application Server for ABAP
CVE-2026-24316

6.4MEDIUM

Key Information:

Vendor

SAP
Status
SAP Netweaver Application Server For Abap
Vendor
CVE Published:
10 March 2026

What is CVE-2026-24316?

The SAP NetWeaver Application Server for ABAP includes an ABAP Report designed for testing that is susceptible to Server-Side Request Forgery (SSRF). This vulnerability enables unauthorized HTTP requests to be sent to internal or external endpoints, potentially allowing attackers to interact with sensitive internal resources. While this could compromise data confidentiality and integrity, the application's availability remains unaffected.

Affected Version(s)

SAP NetWeaver Application Server for ABAP SAP_BASIS 740

SAP NetWeaver Application Server for ABAP SAP_BASIS 750

SAP NetWeaver Application Server for ABAP SAP_BASIS 751

References

https://me.sap.com/notes/3689080
https://url.sap/sapsecuritypatchday

CVSS V3.1

Score:
6.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.