This vulnerability (CVE-2026-40137) affects SAP SE's Business Server Pages Application (TAF_APPLAUNCHER) versions ST-PI 740 and 758. It involves improper neutralization of input during web page generation, enabling an unauthenticated attacker to create malicious links that redirect users to attacker-controlled sites. This can lead to limited confidentiality and integrity impacts in the victim's browser session. The CVSS 3.1 base score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, scope changed, and low confidentiality and integrity impacts. There is no known exploit in the wild and no vendor-provided patch or remediation level at this time.

The vulnerability allows attackers to redirect users to malicious sites, which may result in limited exposure or alteration of sensitive information within the victim's browser context. There is no impact on the availability of the affected application. The confidentiality and integrity impacts are assessed as low.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided by the vendor, users should monitor SAP advisories for updates. Until a patch is available, organizations should consider limiting exposure to affected versions and educating users about the risks of clicking untrusted links related to this application.