CVE-2026-24328 is a vulnerability identified in the SAP Business Server Pages Application component known as TAF_APPLAUNCHER, specifically affecting versions ST-PI 2008_1_700, 2008_1_710, 740, and 758. The flaw is categorized under CWE-601, which involves URL redirection to untrusted sites. An unauthenticated attacker can craft malicious URLs that, when clicked by a victim, cause the victim's browser to be redirected to attacker-controlled domains. This redirection can potentially expose or alter sensitive information within the victim's browser session, such as session tokens or confidential data, through phishing or other social engineering techniques. The vulnerability does not require authentication but does require user interaction (clicking the malicious link). The CVSS v3.1 score of 6.1 reflects a medium severity, with attack vector being network, low attack complexity, no privileges required, user interaction required, and a scope change. The impact on confidentiality and integrity is low, and there is no impact on availability. No patches or exploits are currently publicly available, but the vulnerability is published and should be addressed proactively. The vulnerability highlights the importance of proper input validation and URL sanitization in web applications to prevent open redirect issues that can facilitate phishing and session hijacking attacks.

For European organizations, this vulnerability poses a moderate risk primarily through social engineering and phishing attacks that leverage the open redirect to attacker-controlled sites. Confidentiality could be compromised if sensitive session information or credentials are exposed during redirection. Integrity risks arise if attackers manipulate the victim's browser context or inject malicious content via the redirection. Although availability is unaffected, the reputational damage and potential data leakage could have significant consequences, especially for enterprises handling sensitive personal data under GDPR. Organizations relying heavily on SAP Business Server Pages for critical business processes may face increased risk of targeted phishing campaigns exploiting this vulnerability. The lack of authentication requirement and ease of exploitation via crafted URLs increase the attack surface. However, the necessity of user interaction limits automated exploitation. Overall, the impact is medium but could escalate if combined with other attack vectors or social engineering tactics.

European organizations should immediately verify if they are running affected versions of SAP ST-PI components (2008_1_700, 2008_1_710, 740, 758) and prioritize upgrading to patched versions once available. In the interim, implement strict URL validation and sanitization controls within SAP Business Server Pages to prevent open redirects. Deploy web application firewalls (WAFs) with rules to detect and block suspicious redirect patterns. Conduct targeted user awareness training focusing on phishing risks associated with suspicious links, emphasizing verification of URLs before clicking. Monitor logs for unusual redirect activity and implement browser security policies such as Content Security Policy (CSP) to restrict navigation to trusted domains. Consider disabling or restricting the use of the TAF_APPLAUNCHER component if not essential. Collaborate with SAP support for any vendor-specific mitigations or patches. Regularly review and update incident response plans to include scenarios involving open redirect exploitation.