CVE-2026-76974: SAP Fiori Launchpad XSS Vulnerability

CVE-2026-76974 Overview

CVE-2026-76974 is an improper input validation vulnerability in SAP Fiori Launchpad. The flaw allows an unauthenticated attacker to craft a malicious link that, when clicked by an authenticated user, causes the browser to load attacker-controlled content from an external location. Successful exploitation can exfiltrate sensitive information from the victim's session. The issue is tracked under [CWE-95] (Improper Neutralization of Directives in Dynamically Evaluated Code) and affects confidentiality only, with no impact on integrity or availability. SAP addressed the flaw as part of its Security Patch Day process.

Critical Impact
An authenticated user's session data can be exfiltrated to an attacker-controlled endpoint after a single click on a crafted Fiori Launchpad link.

Affected Products

SAP Fiori Launchpad (specific versions listed in SAP Note #3680888)

Discovery Timeline

2026-09-22 - CVE-2026-76974 published to the National Vulnerability Database (NVD)
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-76974

Vulnerability Analysis

SAP Fiori Launchpad fails to sufficiently validate certain user-controlled input passed through URL parameters. An attacker builds a link that embeds attacker-controlled content or redirection instructions. When an authenticated Fiori user clicks the link, the Launchpad renders or loads the external content within the authenticated session context.

The attacker does not need credentials or prior access. Exploitation requires user interaction and specific browser or session conditions, which raises attack complexity. The end result is disclosure of session-scoped data such as tokens, cookies, or business information rendered in the Launchpad.

Root Cause

The root cause is missing or insufficient neutralization of user-supplied input before it is used to construct dynamic content in the Fiori Launchpad. Under [CWE-95], input intended as data reaches a context where the application treats it as executable directives or trusted content, enabling loading of remote attacker-controlled resources.

Attack Vector

The attack vector is network-based and relies on social engineering. An attacker delivers a crafted Fiori Launchpad URL through phishing email, chat, or a compromised web page. When an authenticated SAP user opens the link, the Launchpad processes the malicious parameter and initiates the exfiltration path. No further interaction beyond the initial click is required.

No public proof-of-concept or exploitation activity has been reported. Technical details are restricted to authenticated customers via SAP Note #3680888.

Detection Methods for CVE-2026-76974

Indicators of Compromise

Outbound HTTP or HTTPS requests from user browsers to unfamiliar domains immediately after loading a Fiori Launchpad URL.
Fiori Launchpad access logs containing unusual query parameters, encoded payloads, or references to external hosts.
Referrer headers on external requests that trace back to Fiori Launchpad endpoints under /sap/bc/ui2/flp or similar paths.

Detection Strategies

Inspect web proxy and Fiori gateway logs for Launchpad requests containing URL parameters that reference external URLs, IP addresses, or unusual character encodings.
Correlate authenticated Fiori sessions with subsequent outbound requests to low-reputation domains within the same browser session.
Deploy content security policy (CSP) reporting on Fiori endpoints to surface attempts to load third-party scripts, iframes, or images.

Monitoring Recommendations

Enable and centralize SAP Web Dispatcher and Fiori Launchpad access logs in a SIEM for parameter and referrer analysis.
Alert on phishing campaigns targeting SAP business users, especially messages containing Fiori Launchpad URLs from external senders.
Track user reports of unexpected redirects, external content, or authentication prompts inside Fiori sessions.

How to Mitigate CVE-2026-76974

Immediate Actions Required

Apply the SAP-provided patch referenced in SAP Note #3680888 during the next available maintenance window.
Review the SAP Security Patch Day bulletin to identify all Fiori Launchpad instances requiring updates.
Notify SAP users of active phishing risk and remind them not to click Fiori Launchpad links received from untrusted sources.

Patch Information

SAP released a fix as part of Security Patch Day. Customers must authenticate to the SAP Support Portal to retrieve SAP Note #3680888, which contains the affected component versions, corrected support package levels, and manual configuration steps. Apply the note through standard SAP transport procedures and validate Fiori Launchpad functionality in a non-production environment first.

Workarounds

Configure a strict Content Security Policy on Fiori Launchpad responses to block loading of unapproved external content.
Restrict Fiori Launchpad access to trusted networks or through a reverse proxy that filters suspicious URL parameters.
Enable web application firewall rules that inspect and normalize URL parameters passed to Fiori Launchpad endpoints.

bash

# Example WAF rule concept for filtering external URL parameters to Fiori Launchpad
# Deny requests to Fiori paths containing embedded external URLs in query parameters
SecRule REQUEST_URI "@beginsWith /sap/bc/ui2/flp" \
  "chain,deny,status:403,id:1076974,msg:'Potential CVE-2026-76974 exploitation attempt'"
  SecRule ARGS "@rx (https?%3A%2F%2F|https?://)" "t:lowercase,t:urlDecodeUni"