CVE-2026-24316: Server-Side Request Forgery (SSRF) in SAP NetWeaver Application Server for ABAP
SAP NetWeaver Application Server for ABAP provides an ABAP Report for testing purposes, which allows to send HTTP requests to arbitrary internal or external endpoints. The report is therefore vulnerable to Server-Side Request Forgery (SSRF). Successful exploitation could lead to interaction with potentially sensitive internal endpoints, resulting in a low impact on data confidentiality and integrity. There is no impact on availability of the application.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-24316?
CVE-2026-24316 is considered a critical vulnerability due to its potential to exploit internal networks through Server-Side Request Forgery.
How do I fix CVE-2026-24316?
To fix CVE-2026-24316, you should apply the latest security patches provided by SAP for the NetWeaver Application Server for ABAP.
What systems are affected by CVE-2026-24316?
CVE-2026-24316 affects SAP NetWeaver Application Server for ABAP due to its internal HTTP request handling.
What are the potential impacts of CVE-2026-24316?
The main impact of CVE-2026-24316 is unauthorized access to internal systems and data, leading to data breaches or compromise.
Is CVE-2026-24316 being actively exploited?
As of the latest updates, CVE-2026-24316 is not reported to be actively exploited in the wild, but it remains a significant risk if not mitigated.