SAP Fiori Launchpad XSS via Unvalidated Input
CVE-2026-76974 Published on September 22, 2026
Information Disclosure vulnerability in SAP Fiori Launchpad
SAP Fiori Launchpad does not sufficiently validate certain user-controlled input. An unauthenticated attacker could craft a malicious link that, when clicked by an authenticated user, causes the browser to load attacker-controlled content from an external location. This could be used to exfiltrate sensitive information from the victim's session, resulting in a high impact on confidentiality. There is no impact on integrity and availability.
Vulnerability Analysis
CVE-2026-76974 is exploitable with network access, requires user interaction. This vulnerability is consided to have a high level of attack complexity. The potential impact of an exploit of this vulnerability is considered to have a high impact on confidentiality, with no impact on integrity and availability.
Weakness Type
What is an Eval Injection Vulnerability?
The software receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval"). This may allow an attacker to execute arbitrary code, or at least modify what code can be executed.
CVE-2026-76974 has been classified to as an Eval Injection vulnerability or weakness.
Products Associated with CVE-2026-76974
Want to know whenever a new CVE is published for SAP Fiori Launchpad? stack.watch will email you.
Affected Versions
SAP_SE SAP Fiori Launchpad:- Version SAP_UI 757 is affected.
- Version 758 is affected.
- Version 816 is affected.
- Version SAP_BASIS 918 is affected.