PT-2026-7227 · Sap · Taf Applauncher+1

Published 2026-02-10 · Updated 2026-02-13 · CVE-2026-24328

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions SAP (affected versions not specified)

Description An unauthenticated attacker can create malicious links. Clicking these links by a victim redirects them to attacker-controlled sites, potentially exposing or altering sensitive information within the victim’s browser. This poses a low risk to the confidentiality and integrity of data, and does not affect application availability. The issue resides within the TAF APPLAUNCHER component of Business Server Pages.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

CVE-2026-24328

Affected Products

Sap

Taf Applauncher

References · 7

• https://osv.dev/vulnerability/CVE-2026-24328 · Vendor Advisory
• https://url.sap/sapsecuritypatchday · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-24328 · Security Note
• https://t.me/CVEtracker/44259 · Telegram Post
• https://twitter.com/OstorlabSec/status/2022265097326915824 · Twitter Post
• https://me.sap.com/notes/3688319 · Note
• https://twitter.com/VulmonFeeds/status/2021211720190922920 · Twitter Post