medium2026-10-13SAP NetWeaver AS ABAP — test reportCVE-2026-24316
Server-Side Request Forgery in an ABAP Test Report
SAP NetWeaver AS ABAP
Our Take
Test reports have no business being reachable in production. Confirm the authorizations that expose it, then patch.
Vulnerability Detail
A test report in AS ABAP can be abused to make server-side requests. Listed as an update to an earlier note.
Patch Action
Check whether the note applies to your release, then apply SAP Note 3689080.
Affected Versions
SAP_BASIS 816 SP00 (applicability check)
Patch Info