Is CVE-2026-24316 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-24316 being exploited in the wild.

How severe is CVE-2026-24316?

Medium severity, with a CVSS score of 6.4, published 10 March 2026.

Which products and versions are affected?

SAP NetWeaver Application Server for ABAP 740, 750, 752, 753, 754, 755, 756, 757, 758, 816, 918.

Is there a fix for CVE-2026-24316?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-24316 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-24316?

Check whether you run SAP NetWeaver Application Server for ABAP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-24316: SAP NetWeaver AS ABAP SSRF in ABAP Test Report

CVE-2026-24316 · Severity: medium · CVSS 6.4 · Published 2026-03-10

SAP NetWeaver Application Server for ABAP contains a testing tool that can be misused to send unauthorized network requests. An attacker with basic user access could use this tool to probe internal systems or access sensitive data that is normally protected by the corporate firewall. While this does not crash the system, it could lead to the exposure of internal business information.

Technologies: SAP NetWeaver Application Server for ABAP. Vendors: SAP.

Quick answers

Is CVE-2026-24316 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-24316 being exploited in the wild.
How severe is CVE-2026-24316?: Medium severity, with a CVSS score of 6.4, published 10 March 2026.
Which products and versions are affected?: SAP NetWeaver Application Server for ABAP 740, 750, 752, 753, 754, 755, 756, 757, 758, 816, 918.
Is there a fix for CVE-2026-24316?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-24316 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-24316?: Check whether you run SAP NetWeaver Application Server for ABAP at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in an ABAP Report designed for testing purposes within SAP NetWeaver Application Server for ABAP. The report fails to properly validate or restrict the destination of HTTP requests, allowing an attacker with low-privileged network access to relay requests through the server. This can be used to interact with internal metadata services, internal network endpoints, or external systems. The vulnerability is tracked as CWE-918 and affects multiple SAP_BASIS versions. Successful exploitation has a low impact on confidentiality and integrity, with no impact on availability.

Affected products

SAP NetWeaver Application Server for ABAP 740, 750, 752, 753, 754, 755, 756, 757, 758, 816, 918

Timeline

2026-03-10: disclosed
2026-03-10: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.