CVE-2026-24316CWE-918

Server-Side Request Forgery (SSRF) in SAP NetWeaver Application Server for ABAP

Medium · published March 10, 2026

CVSS v3.1
6.4
EPSS
0%
Percentile
6.0
In the wild
Unconfirmed
What it is

SAP NetWeaver Application Server for ABAP provides an ABAP Report for testing purposes, which allows to send HTTP requests to arbitrary internal or external endpoints. The report is therefore vulnerable to Server-Side Request Forgery (SSRF). Successful exploitation could lead to interaction with potentially sensitive internal endpoints, resulting in a low impact on data confidentiality and integrity. There is no impact on availability of the application.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00169 · 6.0th percentile
Weakness
CWE-918 · Server-Side Request Forgery (SSRF)
Published
2026-03-10T00:17Z
EPSS history
Timeline
  • 10 MAR 00:17Z
    Server-Side Request Forgery (SSRF) in SAP NetWeaver Application Server for ABAP
    cvelistv5