CVE-2026-24328 - Open Redirection vulnerability in Business Server Pages Application (TAF_APPLAUNCHER)

Back Back to CVE browser

MEDIUM

Open Redirection vulnerability in Business Server Pages Application (TAF_APPLAUNCHER)

Published Feb 10, 2026

6.1

MEDIUM

CVSS 3.1

EPSS 0.18%

Description

SAP TAF_APPLAUNCHER within Business Server Pages allows unauthenticated attacker to craft malicious links that, when clicked by a victim, redirect them to attacker?controlled sites, potentially exposing or altering sensitive information in the victim�s browser. This results in a low impact on confidentiality and integrity, with no impact on the availability of the application.

Affected products

Vendor SAP SE Product Business Server Pages Application (TAF APPLAUNCHER) Default
unaffected
- Version
  2008_1_710
  Status
  affected
  Constraints
  -
- Version
  740
  Status
  affected
  Constraints
  -
- Version
  758
  Status
  affected
  Constraints
  -
- Version
  ST-PI 2008_1_700
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

SAP SE

Business Server Pages Application (TAF APPLAUNCHER)

unaffected

Version	Status	Constraints
2008_1_710	affected	-
740	affected	-
758	affected	-
ST-PI 2008_1_700	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-601

Open Redirect

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-6874
Advisory
https://me.sap.com/notes/3688319
Permissions Required
https://url.sap/sapsecuritypatchday
Vendor Advisory

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-6874		Advisory
https://me.sap.com/notes/3688319		Permissions Required
https://url.sap/sapsecuritypatchday		Vendor Advisory