CVE-2026-40137 — Cross-Site Scripting (XSS) vulnerability in Business Server Pages Application (TAF_APPLAUNCHER)

CVE-2026-40137

Cross-Site Scripting (XSS) vulnerability in Business Server Pages Application (TAF_APPLAUNCHER) PUBLISHED

Description (CNA)

SAP TAF_APPLAUNCHER within Business Server Pages allows an unauthenticated attacker to craft malicious links that, when clicked by a victim, redirects them to attacker?controlled sites, potentially exposing or altering sensitive information in the victim�s browser. This results in a low impact on confidentiality and integrity, with no impact on the availability of the application.

Affected (CNA)

Vendor / product	Versions
SAP_SE / Business Server Pages Application (TAF_APPLAUNCHER)	affected ST-PI 740; affected 758

CWE

CWE-79

References

https://me.sap.com/notes/3727717
https://url.sap/sapsecuritypatchday

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.