CVE-2026-0513: SAP SRM Open Redirect Vulnerability

CVE-2026-0513 Overview

An Open Redirect vulnerability exists in SAP Supplier Relationship Management (SRM), specifically within the SICF Handler in the SRM Catalog component. This vulnerability allows an unauthenticated attacker to craft a malicious URL that, when accessed by a victim, redirects them to an attacker-controlled site. The vulnerability is classified as CWE-601 (URL Redirection to Untrusted Site), a common web application security flaw that can be leveraged for phishing attacks and credential theft.

Critical Impact

Unauthenticated attackers can redirect users to malicious sites, potentially enabling phishing attacks, credential harvesting, or malware distribution through abuse of trusted SAP domain reputation.

Affected Products

• SAP Supplier Relationship Management (SRM)
• SAP SRM Catalog (SICF Handler component)

Discovery Timeline

• 2026-01-13 - CVE CVE-2026-0513 published to NVD
• 2026-01-13 - Last updated in NVD database

Technical Details for CVE-2026-0513

Vulnerability Analysis

This Open Redirect vulnerability resides in the SICF (SAP Internet Communication Framework) Handler within the SAP SRM Catalog module. The vulnerability allows manipulation of redirect URLs without proper validation, enabling attackers to abuse the trusted SAP domain to redirect unsuspecting users to malicious external sites.

Open redirect vulnerabilities are particularly dangerous in enterprise environments like SAP because users inherently trust URLs originating from their organization's SAP systems. When a user clicks a link that appears to be a legitimate SAP URL, they may not notice being redirected to an attacker-controlled domain. This trust relationship makes the vulnerability ideal for social engineering and phishing campaigns targeting SAP users.

The attack requires user interaction—specifically, a victim must click the malicious URL. However, because the initial URL appears legitimate (pointing to the organization's SAP SRM system), users are more likely to trust and click such links, especially when received through email or other communication channels.

Root Cause

The root cause is improper validation of URL redirect parameters within the SICF Handler component of SAP SRM Catalog. The application fails to adequately validate or sanitize user-supplied redirect URLs, allowing external domains to be specified as redirect targets. This lack of input validation on redirect parameters is a common implementation oversight that enables attackers to abuse the application's redirect functionality.

Attack Vector

The attack is network-based and requires no authentication or special privileges. An attacker crafts a malicious URL containing the legitimate SAP SRM domain with a redirect parameter pointing to an attacker-controlled site. The attacker then distributes this URL through phishing emails, social media, or other communication channels.

When a victim clicks the link, they are initially directed to the legitimate SAP SRM application, which then redirects them to the malicious site. This two-step process abuses the victim's trust in the SAP domain while ultimately delivering them to an attacker-controlled destination. Common attack scenarios include:

• Phishing pages designed to harvest SAP credentials
• Drive-by download sites distributing malware
• Fake error pages requesting "re-authentication"

The attack does not impact confidentiality or availability of the SAP system itself, but poses integrity concerns as it abuses the application's redirect mechanism.

Detection Methods for CVE-2026-0513

Indicators of Compromise

• URLs containing the SAP SRM domain with unusual redirect parameters pointing to external domains
• Web access logs showing redirect requests to domains outside the organization's trusted list
• User reports of unexpected redirections after clicking SAP-related links

Detection Strategies

• Monitor web access logs for requests to the SRM Catalog SICF handler containing external URLs in redirect parameters
• Implement egress filtering to detect and alert on redirects to untrusted domains originating from SAP systems
• Deploy URL inspection on email gateways to identify crafted URLs abusing the SAP redirect vulnerability
• Utilize SIEM rules to correlate SAP access with subsequent suspicious domain connections

Monitoring Recommendations

• Enable detailed logging on the SAP SICF Handler component to capture all redirect requests
• Configure alerts for high volumes of redirect requests or redirects to newly registered domains
• Monitor for phishing campaigns using organizational SAP domains in malicious URLs
• Implement web proxy logging to track user sessions from SAP access through external redirects

How to Mitigate CVE-2026-0513

Immediate Actions Required

• Apply the security patch referenced in SAP Note #3638716 as soon as possible
• Review and restrict access to the affected SICF Handler component if patching is delayed
• Notify users to be cautious of SAP SRM links received via email until the patch is applied
• Implement URL filtering to block known malicious redirect targets

Patch Information

SAP has released a security patch to address this vulnerability. Organizations should review and apply the fix documented in SAP Note #3638716. Additional details about this and other security updates are available on the SAP Security Patch Day Announcement.

Workarounds

• Implement a web application firewall (WAF) rule to validate redirect parameters against an allowlist of trusted domains
• Temporarily disable or restrict access to the affected SICF service handler if it is not critical to operations
• Configure the SAP system to only allow redirects to internal or pre-approved domains
• Educate users about verifying destination URLs before entering credentials, even when the initial link appears legitimate

# Example WAF rule concept for blocking external redirects
# This should be adapted to your specific WAF solution

# Block redirect parameters containing external domains
SecRule ARGS:redirect "@rx ^https?:\/\/(?!.*\.yourcompany\.com)" \
    "id:1001,phase:2,deny,status:403,msg:'Blocked external redirect attempt'"