PT-2026-24158 · Sap · Sap Netweaver Application Server Abap

Published 2026-03-10 · Updated 2026-06-03 · CVE-2026-24316

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP NetWeaver Application Server for ABAP (affected versions not specified)

Description The software includes an ABAP Report designed for testing that enables sending HTTP requests to any internal or external endpoint. This functionality is susceptible to Server-Side Request Forgery (SSRF). Successful exploitation may allow interaction with sensitive internal endpoints, potentially impacting data confidentiality and integrity. The application's availability is not affected. The report allows requests to arbitrary endpoints via the use of an ABAP Report. The vulnerable component is an ABAP Report used for testing.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-24316

Affected Products

Sap Netweaver Application Server Abap

References · 9

• https://url.sap/sapsecuritypatchday · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24316 · Security Note
• https://twitter.com/infoflowcloud/status/2031295478139130000 · Twitter Post
• https://t.me/CVEtracker/46964 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2031502370262167697 · Twitter Post
• https://t.me/cveNotify/154954 · Telegram Post
• https://twitter.com/CVEnew/status/2031294587013337517 · Twitter Post
• https://me.sap.com/notes/3689080 · Note
• https://t.me/cveNotify/165845 · Telegram Post