CVE-2026-24316 · CVSS 3.0 6.4 · SAP Note 3689080
October’s change to Note 3689080 widens where the correction can be applied. Version 16 extends the SAP_BASIS 816 correction validity to SP00; it previously started at SP01. The underlying SSRF vulnerability was first released on 10 March 2026.
The original exposure
A test ABAP report could send HTTP requests to arbitrary internal or external endpoints. An authenticated user with basic authorization to execute arbitrary ABAP reports could use it to interact with sensitive internal services. SAP rates CVE-2026-24316 at 6.4, Medium priority, with low confidentiality and integrity impacts and no availability impact.
An unused report is removed
SAP’s correction removes the vulnerable report because it is no longer in use. Implement the applicable correction instruction or support package. The component table lists SAP_BASIS 740, the 750–816 range and 918. Listed package entries include SAP_BASIS 816 SP02 and 918 SP01; the correction instructions provide the alternative for applicable lower levels.
Revisit systems marked outside the earlier validity
If an 816 SP00 system was previously recorded as unable to implement this correction, reassess it using version 16. The March revision made a comparable validity change for release 758 SP00, but October’s documented change is for 816. Keep the original vulnerability date and the new note version distinct in reporting. Review who can execute general-purpose reports and check correction status on each applicable system; an October release date alone does not make this a newly discovered SSRF flaw.
Advisory details
Component: BC-TWB-TST-ECA
SAP priority: Correction with medium priority
First release: 10.03.2026
Reviewed release: 13 October 2026, note version 16
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Source: SAP Security Note 3689080 (SAP for Me; sign-in may be required). The patch and workaround details above reflect the version reviewed on 13 October 2026. Check the current note for subsequent changes.
