CVE-2026-34257
Full vulnerability record from the local CVENow database.
Description
Due to an Open Redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft malicious URL that, if accessed by a victim, they could be redirected to the page controlled by the attacker. This causes low impact on confidentiality and integrity of the application with no impact on availability.
Severity
MEDIUM
CVSS score
6.1
(v3.1)
Vulnerability status
Analyzed
Source identifier
Published
2026-04-14 01:16:03.730000
Last modified
2026-10-26 21:10:00.170000
View original CVE JSON
{
"id": "CVE-2026-34257",
"sourceIdentifier": "[email protected]",
"published": "2026-04-14T01:16:03.730",
"lastModified": "2026-10-26T21:10:00.170",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Due to an Open Redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft malicious URL that, if accessed by a victim, they could be redirected to the page controlled by the attacker. This causes low impact on confidentiality and integrity of the application with no impact on availability."
},
{
"lang": "es",
"value": "Debido a una vulnerabilidad de redirección abierta en SAP NetWeaver Servidor de Aplicaciones ABAP, un atacante no autenticado podría crear una URL maliciosa que, si es accedida por una víctima, podría ser redirigida a la página controlada por el atacante. Esto causa bajo impacto en la confidencialidad e integridad de la aplicación sin impacto en la disponibilidad."
}
],
"affected": [
{
"source": "[email protected]",
"affectedData": [
{
"vendor": "SAP_SE",
"product": "SAP NetWeaver Application Server ABAP",
"defaultStatus": "unaffected",
"versions": [
{
"version": "SAP_BASIS 700",
"status": "affected"
},
{
"version": "SAP_BASIS 701",
"status": "affected"
},
{
"version": "SAP_BASIS 702",
"status": "affected"
},
{
"version": "SAP_BASIS 731",
"status": "affected"
},
{
"version": "SAP_BASIS 740",
"status": "affected"
},
{
"version": "SAP_BASIS 750",
"status": "affected"
},
{
"version": "SAP_BASIS 752",
"status": "affected"
},
{
"version": "SAP_BASIS 753",
"status": "affected"
},
{
"version": "SAP_BASIS 754",
"status": "affected"
},
{
"version": "SAP_BASIS 755",
"status": "affected"
},
{
"version": "SAP_BASIS 756",
"status": "affected"
},
{
"version": "SAP_BASIS 757",
"status": "affected"
},
{
"version": "SAP_BASIS 758",
"status": "affected"
},
{
"version": "SAP_BASIS 816",
"status": "affected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "NONE",
"userInteraction": "REQUIRED",
"scope": "CHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2026-04-14T12:53:41.554329Z",
"id": "CVE-2026-34257",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-601"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:700:*:*:*:sap_basis:*:*:*",
"matchCriteriaId": "6F048ED9-2DDF-4EB9-8571-73832AFABF6A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:701:*:*:*:sap_basis:*:*:*",
"matchCriteriaId": "C37DC475-6B9A-493C-9A6F-28CDD65D2A5B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:702:*:*:*:sap_basis:*:*:*",
"matchCriteriaId": "2BD9FE51-F76C-439A-A3C0-5279EC1059F7"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:731:*:*:*:sap_basis:*:*:*",
"matchCriteriaId": "4EB54432-0E1A-45F2-BEE1-8DC28FAADA9F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:740:*:*:*:sap_basis:*:*:*",
"matchCriteriaId": "8E96C58C-ED44-487B-A67E-FDAE3C29023A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:750:*:*:*:sap_basis:*:*:*",
"matchCriteriaId": "A14DF5EB-B8CE-4A47-9959-2F65A5DCEF5F"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:752:*:*:*:sap_basis:*:*:*",
"matchCriteriaId": "419BA423-0803-4F51-8889-014A521F02CE"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:753:*:*:*:sap_basis:*:*:*",
"matchCriteriaId": "DA20ECDC-8807-462C-A0F0-70DF6F5A119B"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:754:*:*:*:sap_basis:*:*:*",
"matchCriteriaId": "800AAC21-325C-4F16-AE5A-9F89327E5356"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:755:*:*:*:sap_basis:*:*:*",
"matchCriteriaId": "BDC15DB7-A95B-475F-AAA6-60A801F65690"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:756:*:*:*:sap_basis:*:*:*",
"matchCriteriaId": "55A2FECF-A32E-4188-9563-E8BA0E952261"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:757:*:*:*:sap_basis:*:*:*",
"matchCriteriaId": "9CBF2E53-17F0-4BF0-9C38-749C7E611BF4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:758:*:*:*:sap_basis:*:*:*",
"matchCriteriaId": "5160572B-E3AB-4B96-8950-07DDAFA0E4A6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:sap:netweaver_application_server_abap:816:*:*:*:sap_basis:*:*:*",
"matchCriteriaId": "32888162-53F9-4598-8C04-E4A4903AAB57"
}
]
}
]
}
],
"references": [
{
"url": "https://me.sap.com/notes/3692004",
"source": "[email protected]",
"tags": [
"Permissions Required"
]
},
{
"url": "https://url.sap/sapsecuritypatchday",
"source": "[email protected]",
"tags": [
"Vendor Advisory"
]
}
]
}