What’s Vulnerable › Vulnerabilities

CVE-2025-42941: Reverse Tabnabbing vulnerability in SAP Fiori (Launchpad)

• Severity: low (CVSS 3.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-08-12 · updated 2026-06-17
• Weakness: CWE-1022

Description

SAP Fiori (Launchpad) is vulnerable to Reverse Tabnabbing vulnerability due to inadequate external navigation protections for its link (<a>) elements. An attacker with administrative user privileges could exploit this by leveraging compromised or malicious pages. While administrative access is necessary for certain configurations, the attacker does not need the administrative privileges to execute the attack. This could result in unintended manipulation of user sessions or exposure of sensitive information. The issue impacts the confidentiality and integrity of the system, but the availability remains unaffected.

Affected products

• SAP_SE SAP Fiori Launchpad: SAP_UI 754

References

• https://me.sap.com/notes/3624943
• https://url.sap/sapsecuritypatchday

Get alerted when CVE-2025-42941 or the next vulnerability affects your stack