CVE-2026-24315: SAP Fiori Launchpad CSRF Vulnerability

CVE-2026-24315 Overview

CVE-2026-24315 affects the SAP Fiori Launchpad, where attackers can craft malicious URLs that trigger arbitrary service calls on the Fiori domain. When a user opens the crafted URL, the request executes in the context of the Fiori application and may expose credentials or session material to the attacker.

The flaw is categorized as a URL redirection and origin-trust weakness [CWE-35]. Exploitation requires user interaction and advanced knowledge of the target system, which limits scale but does not eliminate risk for high-value SAP environments.

Critical Impact

Successful exploitation can lead to account compromise through credential theft when a victim opens an attacker-crafted Fiori Launchpad URL.

Affected Products

• SAP Fiori Launchpad (see SAP Note 3682699 for affected component versions)
• SAP environments exposing the Fiori Launchpad to end users
• SAP frontend deployments integrated with Fiori service endpoints

Discovery Timeline

• 2026-06-09 - CVE-2026-24315 published to the National Vulnerability Database (NVD)
• 2026-06-09 - SAP publishes SAP Note 3682699 as part of SAP Security Patch Day
• 2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-24315

Vulnerability Analysis

The vulnerability resides in how the SAP Fiori Launchpad processes URL parameters that control downstream service invocations. An attacker constructs a URL pointing to the legitimate Fiori domain but embeds parameters that cause the Launchpad to issue arbitrary service calls when the victim opens the link.

Because the request originates from the trusted Fiori origin and runs within the authenticated user's session, the resulting service calls inherit user privileges. Attackers can chain this behavior to capture credentials, tokens, or sensitive responses tied to the authenticated session.

The Exploit Prediction Scoring System (EPSS) currently places this issue at a low likelihood of near-term exploitation, but targeted abuse remains plausible in environments where Fiori is internet-facing.

Root Cause

The root cause is insufficient validation of URL-supplied parameters that influence the destination and content of service calls made by the Fiori Launchpad. The Launchpad trusts attacker-controlled input to determine which service endpoint to invoke on its own domain, violating the principle of strict origin and target validation referenced in [CWE-35].

Attack Vector

The attack is network-based and requires user interaction. An attacker delivers the crafted URL through phishing, chat, or any channel where an authenticated SAP user may click it. Successful exploitation also requires advanced knowledge of the target SAP system, including valid service paths and parameter structures, which raises the attacker skill bar.

No verified public proof-of-concept code is available. Refer to the SAP Note 3682699 and the SAP Security Patch Day Update for vendor-supplied technical details.

Detection Methods for CVE-2026-24315

Indicators of Compromise

• Unusual Fiori Launchpad URLs containing redirection parameters or service paths that reference non-standard endpoints.
• Authenticated service calls to Fiori backends initiated immediately after a user clicks an external link.
• Outbound HTTP traffic from Fiori service responses to attacker-controlled hosts shortly after user URL interaction.

Detection Strategies

• Inspect web proxy and reverse proxy logs for Fiori Launchpad requests carrying suspicious query parameters or encoded URLs.
• Correlate email or messaging gateway events with subsequent Fiori session activity to identify URL-driven exploitation chains.
• Alert on authenticated SAP sessions that issue rapid sequences of unrelated service calls following a single inbound navigation event.

Monitoring Recommendations

• Centralize SAP Fiori, web gateway, and identity provider logs in a SIEM for cross-source correlation.
• Monitor for credential reuse from new IP addresses or user agents shortly after Fiori session activity.
• Track changes to SAP authentication tokens and session cookies for anomalies tied to URL-based interactions.

How to Mitigate CVE-2026-24315

Immediate Actions Required

• Apply the corrections described in SAP Note 3682699 to all affected SAP Fiori Launchpad systems.
• Restrict external exposure of the Fiori Launchpad where business requirements allow, using VPN or zero-trust access controls.
• Educate SAP users on phishing risks involving Fiori URLs and reinforce link-handling procedures.

Patch Information

SAP released the official fix on SAP Security Patch Day. Administrators should download and apply the corrections referenced in SAP Note 3682699 and review the consolidated SAP Security Patch Day Update for related notes and dependencies.

Workarounds

• Enforce strict allowlists for Fiori Launchpad navigation targets at the reverse proxy or web dispatcher layer.
• Apply Content Security Policy and Referrer-Policy headers to limit cross-origin behavior on the Fiori domain.
• Require step-up authentication for sensitive Fiori services to reduce the value of any stolen session context.

# Configuration example
# Example SAP Web Dispatcher rule to block suspicious Fiori Launchpad query parameters
# Adjust patterns to match your environment after testing in a non-production system
if %{QUERY_STRING} regimatch (sap-shell|sap-system|redirect|target)=.*(http|https)%3A
  RegRewriteResponse 403 "Blocked suspicious Fiori URL"
end