Cyber Resilience

CVE-2026-24318

Published
14 April 2026
Modified
17 April 2026
CVSS Score v3.1 4.2
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
EPSS Score 0.0017 6th percentile
Risk Priority 33 floored blend · peak EPSS

Summary

CVE-2026-24318 is a medium-severity Use of Persistent Cookies Containing Sensitive Information (CWE-539) vulnerability in Sap (inferred from references). Its CVSS base score is 4.2 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Steal Web Session Cookie (T1539); ranked at the 6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

A06:2025 Insecure Design

EU & UK References

Vulnerability Data

Due to an Insecure session management vulnerability in SAP Business Objects Business Intelligence Platform, an unauthenticated attacker could obtain valid session tokens and reuse them to gain unauthorized access to a victim�s session. If the application continues to accept previously…

more

issued tokens after authentication, the attacker could assume the victim�s authenticated context. This could allow the attacker to access or modify information within the victim�s session scope, impacting confidentiality and integrity, while availability remains unaffected.

CWE(s)
CWE-539

Related Threats

MITRE ATT&CK Enterprise Techniques

T1539 Steal Web Session Cookie Credential Access
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.
attack.mitre.org →
T1550.004 Web Session Cookie Lateral Movement
Adversaries can use stolen session cookies to authenticate to web applications and services.
attack.mitre.org →
T1185 Browser Session Hijacking Collection
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
attack.mitre.org →
T1528 Steal Application Access Token Credential Access
Adversaries can steal application access tokens as a means of acquiring credentials to access remote systems and resources.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-52633Shared CWE-539
CVE-2025-27673Shared CWE-539
CVE-2024-39275Shared CWE-539
CVE-2023-30861Shared CWE-539
CVE-2026-35192Shared CWE-539

Affected Assets

Sap
—
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 full match
prevents

Secure SDLC practices and coding standards directly prohibit storing sensitive data in persistent cookies.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect and prevent use of persistent cookies with sensitive data.

A.5.34 Privacy and protection of PII partial match
mitigates

Privacy and PII protection policies require safeguards against exposing sensitive data via cookies.

A.8.1 User end point devices partial match
degrades

Endpoint device configuration can enforce cookie lifetime and encryption policies.

A.8.10 Information deletion partial match
mitigates

Information deletion policies can mandate removal or encryption of sensitive cookie data.

A.8.12 Data leakage prevention partial match
mitigates

Data leakage prevention controls can block or encrypt sensitive information in cookies.

A.8.24 Use of cryptography partial match
degrades

Cryptographic controls can mandate encryption of sensitive data stored in cookies.

References