medium2026-09-22SAP Fiori LaunchpadCVE-2026-76974
Session Information Exposure via Crafted Link in Fiori Launchpad
SAP Fiori Launchpad
Our Take
Fiori Launchpad is the front door for most S/4 users, so this is worth doing even at a medium score.
Vulnerability Detail
A crafted link can expose sensitive session information in Fiori Launchpad. Published September 22, 2026 and covered with the October cycle.
Patch Action
Apply SAP Note 3680888. Verify affected versions in the official note.
Patch Info