CVE-2026-24315

The record

SAP Fiori Launchpad allows attackers to craft malicious URLs that triggers arbitrary service calls on the Fiori domain, this when opened by the user could compromise accounts by stealing user credentials. Successful exploitation requires adversaries to possess advanced knowledge of the system causing low impact on Confidentiality and Integrity. Availability of the system is no impacted.

Affected packages

Related vulnerabilities

• CVE-2026-85310 import_contacts Path Traversal in Groundhogg <= 4.7.1 versions. CWE-35
• CVE-2026-21103 Path traversal in GalaxyDiagnostics prior to SMR Sep-2026 Release 1 allows physical… CWE-35
• CVE-2026-21092 Path traversal in ImsService prior to SMR Sep-2026 Release 1 allows remote attackers to… CWE-35
• CVE-2026-20513 In Audio HAL, there is a possible information disclosure due to improper input validation. CWE-35
• CVE-2026-59909 Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. CWE-35
• CVE-2026-56089 Dell ObjectScale, versions prior to 4.3.0.1, contain(s) a Path Traversal vulnerability. CWE-35
• CVE-2026-28157 Subscriber Path Traversal in Do Lasso <= 358 versions. CWE-35
• CVE-2026-69109 A vulnerability has been identified in Siemens License Server (SLS) (All versions < V5.3). CWE-35