CVEFinder.io

CVE-2026-34257

đŸ”ļ medium
🔍 Scan for this CVE
Summary

Due to an Open Redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft malicious URL that, if accessed by a victim, they could be redirected to the page controlled by the attacker. This causes low impact on confidentiality and integrity of the application with no impact on availability.

CVSS Score
6.1
Medium
EPSS Score
0.1
Exploit Probability
Published Date
2026-04-14
First Seen: 2026-04-15
📊 Relative Risk Intelligence

This CVE is Lower Risk - more severe than 38.8% of all 330,193 vulnerabilities in our database.

#202,011
Below average severity
Severity Percentile
đŸŽ¯ CISA SSVC Assessment Updated: Apr 14, 2026
🔍 Exploitation Status
None
No known exploits
⚙ī¸ Automatable
NO
Requires human interaction
đŸ’Ĩ Technical Impact
Partial
Limited system impact
SSVC data provided by CISA
Last Modified 2026-06-03
Source NVD 🔗
CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE IDs (Weakness Types)
CWE-601

đŸ“Ļ Affected Products 14

Vendor Product Status Affected Versions
sap netweaver_application_server_abap Affected
v700
sap netweaver_application_server_abap Affected
v701
sap netweaver_application_server_abap Affected
v702
sap netweaver_application_server_abap Affected
v731
sap netweaver_application_server_abap Affected
v740
sap netweaver_application_server_abap Affected
v750
sap netweaver_application_server_abap Affected
v752
sap netweaver_application_server_abap Affected
v753
sap netweaver_application_server_abap Affected
v754
sap netweaver_application_server_abap Affected
v755
sap netweaver_application_server_abap Affected
v756
sap netweaver_application_server_abap Affected
v757
sap netweaver_application_server_abap Affected
v758
sap netweaver_application_server_abap Affected
v816

🔗 References 2

https://me.sap.com/notes/3692004
Permissions Required
https://url.sap/sapsecuritypatchday
Vendor Advisory

🔗 Related CVEs 6

CVE ID Severity CVSS EPSS Summary Published
CVE-2026-27680 ℹī¸ low 3.1 0.0 Due to improper input handling under certain conditions, SAP NetWeaver Application Server ABAP allows an attacker to inj... 2026-05-14
CVE-2026-27682 đŸ”ļ medium 4.7 0.0 Due to a reflected cross-site scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based... 2026-05-12
CVE-2026-40135 đŸ”ļ medium 6.5 0.1 An OS Command Injection vulnerability exists in the SAP NetWeaver Application Server for ABAP and ABAP Platform that all... 2026-05-12
CVE-2026-24309 đŸ”ļ medium 6.4 0.1 Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute... 2026-03-10
CVE-2026-24310 ℹī¸ low 3.5 0.0 Due to missing authorization check in SAP NetWeaver Application Server for ABAP, an authenticated attacker could execute... 2026-03-10
CVE-2026-24316 đŸ”ļ medium 6.4 0.0 SAP NetWeaver Application Server for ABAP provides an ABAP Report for testing purposes, which allows to send HTTP reques... 2026-03-10
These CVEs affect the same products