Sap
Vulnerability activity for Sap: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 0
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 90 days
- CVEs
- 4
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Last 365 days
- CVEs
- 4
- Critical (CVSS 9+)
- 0
- Exploited (CISA KEV)
- 0
- With exploit code
- 0
Next expected patch release
SAP Security Patch Day
Nov 10, 2026, in 12 days
Expected from the vendor's usual schedule; vendors can shift dates.
Exploited now
CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.
- 9.1CriticalMay 13, 2025SAP NetWeaver DeserializationCVE-2025-42999SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deserializing untrusted or malicious content.Added to KEV May 15, 2025 · 2 days after publicationExploited13% likely
- 10.0CriticalApr 24, 2025SAP NetWeaver Path traversal / file handlingCVE-2025-31324SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries.Added to KEV Apr 29, 2025 · 4 days after publicationExploited99% likelyExploit codeNucleiDetection
- 7.5HighAug 7, 2017SAP NetWeaver Path traversal / file handlingCVE-2017-12637SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string.Added to KEV Mar 19, 2025 · 2,780 days after publicationExploited95% likelyExploit codeNucleiDetection
- 9.8CriticalAug 14, 2019SAP Commerce Cloud DeserializationCVE-2019-0344SAP Commerce Cloud (formerly known as Hybris) contains a deserialization of untrusted data vulnerability within the mediaconversion and virtualjdbc extension that allows for code injection.Added to KEV Sep 30, 2024 · 1,873 days after publicationExploited7.5% likely
- 9.8CriticalFeb 9, 2022SAP Multiple ProductsCVE-2022-22536SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the victim or poisoning intermediary Web caches.Added to KEV Aug 18, 2022 · 189 days after publicationExploited98% likelyExploit codeExploit-DB · NucleiDetection
- 5.3MediumFeb 16, 2016SAP NetWeaver Information disclosureCVE-2016-2388The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request.Added to KEV Jun 9, 2022 · 2,304 days after publicationExploited52% likelyExploit codeExploit-DBDetection
- 9.8CriticalFeb 16, 2016SAP NetWeaver SQL injectionCVE-2016-2386SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.Added to KEV Jun 9, 2022 · 2,304 days after publicationExploited72% likelyExploit codeExploit-DBDetection
- 9.9CriticalSep 14, 2021SAP NetWeaver Path traversal / file handlingCVE-2021-38163SAP NetWeaver contains a vulnerability that allows unrestricted file upload.Added to KEV Jun 9, 2022 · 268 days after publicationExploited37% likelyExploit codeDetection
- 7.5HighApr 7, 2016SAP NetWeaver Path traversal / file handlingCVE-2016-3976SAP NetWeaver Application Server Java Platforms contains a directory traversal vulnerability via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet. This allows remote attackers to read files.Added to KEV Nov 3, 2021 · 2,035 days after publicationExploited47% likelyExploit codeExploit-DB
- 10.0CriticalMar 10, 2020SAP Solution Manager Auth bypass / access controlCVE-2020-6207SAP Solution Manager User Experience Monitoring contains a missing authentication for critical function vulnerability which results in complete compromise of all SMDAgents connected to the Solution Manager.Added to KEV Nov 3, 2021 · 602 days after publicationExploited98% likelyExploit codeMetasploit · NucleiDetection
- 10.0CriticalJul 14, 2020SAP NetWeaver Auth bypass / access controlCVE-2020-6287SAP NetWeaver Application Server Java Platforms contains a missing authentication for critical function vulnerability allowing unauthenticated access to execute configuration tasks and create administrative users.Added to KEV Nov 3, 2021 · 476 days after publicationExploited95% likelyExploit codeMetasploit · NucleiDetection
- 6.5MediumNov 23, 2016SAP NetWeaverCVE-2016-9563SAP NetWeaver Application Server Java Platforms contains an unspecified vulnerability in BC-BMT-BPM-DSK which allows remote, authenticated users to conduct XML External Entity (XXE) attacks.Added to KEV Nov 3, 2021 · 1,806 days after publicationExploited24% likely
- 10.0CriticalMay 13, 2016SAP NetWeaver Auth bypass / access controlCVE-2010-5326SAP NetWeaver Application Server Java Platforms Invoker Servlet does not require authentication, allowing for remote code execution via a HTTP or HTTPS request.Added to KEV Nov 3, 2021 · 2,000 days after publicationExploited18% likely
- 6.6MediumMar 1, 2018SAP Customer Relationship Management (CRM) Path traversal / file handlingCVE-2018-2380SAP Customer Relationship Management (CRM) contains a path traversal vulnerability that allows an attacker to exploit insufficient validation of path information provided by users.Added to KEV Nov 3, 2021 · 1,342 days after publicationExploited29% likelyExploit codeExploit-DBDetection
Recent
- 3.7LowAug 11, 2026Sap approuterCVE-2026-58239SAP Approuter does not sufficiently validate tenant context in inbound requests. An unauthenticated attacker could send specially crafted requests to spoof the tenant context under conditions not fully within their control. Successful exploitation could allow limited access to another tenant's information, resulting in a low impact on confidentiality. There is no impact on integrity and availability.
- 5.9MediumAug 11, 2026Sap approuter Denial of serviceCVE-2026-58238SAP Approuter does not sufficiently handle certain requests under specific conditions. An unauthenticated attacker could send specially crafted input that causes the component to crash and restart. Successful exploitation requires specific runtime conditions to be met, making the attack complex to execute. This results in a high impact on availability. There is no impact on confidentiality and integrity.
- 5.9MediumAug 11, 2026Sap approuter Auth bypass / access controlCVE-2026-58237WebSocket of SAP Approuter does not perform sufficient authorization checks in certain functionality. An attacker with low privileges could exploit this to access restricted functionality. Successful exploitation could allow the attacker to read sensitive information and perform limited modifications, resulting in a high impact on confidentiality and a low impact on integrity. There is no impact on availability.
- 7.0HighAug 11, 2026Sap approuterCVE-2026-58230SAP Approuter does not sufficiently validate certain token content under specific configurations. An unauthenticated attacker could send a specially crafted token to cause sensitive credential material to be sent to an attacker-controlled destination. The attack complexity is high due to non-default preconditions required in the target environment. This results in a high impact on confidentiality and a low impact on integrity and availability.
- 9.1CriticalMay 13, 2025SAP NetWeaver DeserializationCVE-2025-42999SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deserializing untrusted or malicious content.Exploited13% likely
- 10.0CriticalApr 24, 2025SAP NetWeaver Path traversal / file handlingCVE-2025-31324SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries.Exploited99% likelyExploit codeNucleiDetection
- 7.5HighAug 7, 2017SAP NetWeaver Path traversal / file handlingCVE-2017-12637SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string.Exploited95% likelyExploit codeNucleiDetection
- 9.8CriticalAug 14, 2019SAP Commerce Cloud DeserializationCVE-2019-0344SAP Commerce Cloud (formerly known as Hybris) contains a deserialization of untrusted data vulnerability within the mediaconversion and virtualjdbc extension that allows for code injection.Exploited7.5% likely
- 6.1MediumMay 9, 2023Sap customer relationship management s4fnd XSSCVE-2023-30742SAP CRM (WebClient UI) - versions S4FND 102, S4FND 103, S4FND 104, S4FND 105, S4FND 106, S4FND 107, WEBCUIF 700, WEBCUIF 701, WEBCUIF 731, WEBCUIF 746, WEBCUIF 747, WEBCUIF 748, WEBCUIF 800, WEBCUIF 801, does not sufficiently encode user-controlled inputs, resulting in a stored Cross-Site Scripting (XSS) vulnerability.An attacker could store a malicious URL and lure the victim to click, causing the script supplied by the attacker to execute in the victim user's session. The information from the
- 6.1MediumMay 9, 2023Sap businessobjects business intelligence XSSCVE-2023-30741Due to insufficient input validation, SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an unauthenticated attacker to redirect users to untrusted site using a malicious link. On successful exploitation, an attacker can view or modify information causing a limited impact on confidentiality and integrity of the application.
- 6.5MediumMar 14, 2023Sap netweaver application server abap Denial of serviceCVE-2023-27270SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulnerabilities in a class for test purposes in which an attacker authenticated as a non-administrative user can craft a request with certain parameters, which will consume the server's resources sufficiently to make it unavailable. There is no ability to view or modify any information.
- 6.1MediumFeb 14, 2023Sap netweaver as abap business server pages XSSCVE-2023-24521Due to insufficient input sanitization, SAP NetWeaver AS ABAP (BSP Framework) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an unauthenticated user to alter the current session of the user by injecting the malicious code over the network and gain access to the unintended data. This may lead to a limited impact on the confidentiality and the integrity of the application.
- 6.5MediumFeb 14, 2023Sap solution manager XSSCVE-2023-0025SAP Solution Manager (BSP Application) - version 720, allows an authenticated attacker to craft a malicious link, which when clicked by an unsuspecting user, can be used to read or modify some sensitive information or craft a payload which may restrict access to the desired resources.
- 9.8CriticalFeb 9, 2022SAP Multiple ProductsCVE-2022-22536SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the victim or poisoning intermediary Web caches.Exploited98% likelyExploit codeExploit-DB · NucleiDetection
- 9.9CriticalSep 14, 2021SAP NetWeaver Path traversal / file handlingCVE-2021-38163SAP NetWeaver contains a vulnerability that allows unrestricted file upload.Exploited37% likelyExploit codeDetection
- 9.8CriticalFeb 16, 2016SAP NetWeaver SQL injectionCVE-2016-2386SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.Exploited72% likelyExploit codeExploit-DBDetection
- 5.3MediumFeb 16, 2016SAP NetWeaver Information disclosureCVE-2016-2388The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request.Exploited52% likelyExploit codeExploit-DBDetection
- 6.6MediumMar 1, 2018SAP Customer Relationship Management (CRM) Path traversal / file handlingCVE-2018-2380SAP Customer Relationship Management (CRM) contains a path traversal vulnerability that allows an attacker to exploit insufficient validation of path information provided by users.Exploited29% likelyExploit codeExploit-DBDetection
- 10.0CriticalMay 13, 2016SAP NetWeaver Auth bypass / access controlCVE-2010-5326SAP NetWeaver Application Server Java Platforms Invoker Servlet does not require authentication, allowing for remote code execution via a HTTP or HTTPS request.Exploited18% likely
- 6.5MediumNov 23, 2016SAP NetWeaverCVE-2016-9563SAP NetWeaver Application Server Java Platforms contains an unspecified vulnerability in BC-BMT-BPM-DSK which allows remote, authenticated users to conduct XML External Entity (XXE) attacks.Exploited24% likely
- 10.0CriticalJul 14, 2020SAP NetWeaver Auth bypass / access controlCVE-2020-6287SAP NetWeaver Application Server Java Platforms contains a missing authentication for critical function vulnerability allowing unauthenticated access to execute configuration tasks and create administrative users.Exploited95% likelyExploit codeMetasploit · NucleiDetection
- 10.0CriticalMar 10, 2020SAP Solution Manager Auth bypass / access controlCVE-2020-6207SAP Solution Manager User Experience Monitoring contains a missing authentication for critical function vulnerability which results in complete compromise of all SMDAgents connected to the Solution Manager.Exploited98% likelyExploit codeMetasploit · NucleiDetection
- 7.5HighApr 7, 2016SAP NetWeaver Path traversal / file handlingCVE-2016-3976SAP NetWeaver Application Server Java Platforms contains a directory traversal vulnerability via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet. This allows remote attackers to read files.Exploited47% likelyExploit codeExploit-DB
Top products
- approuter4 CVEs in the last year
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.