CVE-2026-34257

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-34257
Due to an Open Redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft malicious URL that, if accessed by a victim, they could be redirected to the page controlled by the attacker. This causes low impact on confidentiality and integrity of the application with no impact on availability.

6.1 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://me.sap.com/notes/3692004 Permissions Required
https://url.sap/sapsecuritypatchday Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:sap:netweaver_application_server_abap:700:*:*:*:sap_basis:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:701:*:*:*:sap_basis:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:702:*:*:*:sap_basis:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:731:*:*:*:sap_basis:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:740:*:*:*:sap_basis:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:750:*:*:*:sap_basis:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:752:*:*:*:sap_basis:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:753:*:*:*:sap_basis:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:754:*:*:*:sap_basis:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:755:*:*:*:sap_basis:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:756:*:*:*:sap_basis:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:757:*:*:*:sap_basis:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:758:*:*:*:sap_basis:*:*:*
cpe:2.3:a:sap:netweaver_application_server_abap:816:*:*:*:sap_basis:*:*:*
History

26 Oct 2026, 21:10

Type Values Removed Values Added
Summary
  • (es) Debido a una vulnerabilidad de redirección abierta en SAP NetWeaver Servidor de Aplicaciones ABAP, un atacante no autenticado podría crear una URL maliciosa que, si es accedida por una víctima, podría ser redirigida a la página controlada por el atacante. Esto causa bajo impacto en la confidencialidad e integridad de la aplicación sin impacto en la disponibilidad.
Information

Published : 2026-04-14 01:16

Updated : 2026-10-26 21:10

NVD link : CVE-2026-34257

Mitre link : CVE-2026-34257

CVE.ORG link : CVE-2026-34257

JSON object : View

Products Affected

sap

  • netweaver_application_server_abap
CWE
CWE-601

URL Redirection to Untrusted Site ('Open Redirect')