SAP SE

Exploited now

None of this vendor's CVEs are on CISA's known-exploited list.

Recent

• 4.3MediumOct 13, 2026SAP HANA (Display Product Catalog Based on Customs Declaration) Auth bypass / access controlCVE-2026-89124Display Product Catalog Based on Customs Declaration application does not perform sufficient authorization checks within certain functionality, allowing an authenticated low-privileged user to access sensitive information beyond their intended authorization scope. This vulnerability has low impact o
• 6.1MediumOct 13, 2026SAP NetWeaver Enterprise PortalCVE-2026-89122SAP NetWeaver Enterprise Portal does not sufficiently validate input to a certain portal component. An unauthenticated attacker could craft a malicious link that, when clicked by a victim, loads attacker-controlled content within the trusted application context. Successful exploitation could allow t
• 4.7MediumOct 13, 2026SAP S/4HANA (Linear Asset Management RAP Business Object) Auth bypass / access controlCVE-2026-89121SAP S/4HANA does not perform sufficient instance-level authorization checks for certain modification operations on associated business object data. An attacker with low privileges and local access to the system could bypass authorization checks to modify data belonging to objects they are not author
• 7.1HighOct 13, 2026SAP ABAP PlatformCVE-2026-89120A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from FLP. A low-privileged attacker could exploit this to bypass restrictions via specially crafted requests, resu
• 5.3MediumOct 13, 2026SAP NetWeaver Enterprise Portal Path traversal / file handlingCVE-2026-89118SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to access restricted resources and retrieve non-critical application information, which leads to Low impact on Confidentiality, but there is no impact on Integrity and Availability of the application.
• 6.1MediumOct 13, 2026SAP NetWeaver Enterprise Portal XSSCVE-2026-89117SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter. The scripts are reflected in the server response and executed in a user's browser when the crafted URL is visited, leading to theft of session information, manipulation of portal cont
• 8.8HighOct 13, 2026SAP Commerce Cloud (OOTB Code) SQL injectionCVE-2026-89113SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL commands. Successful exploitation could allow the user to read,
• 9.9CriticalOct 13, 2026SAP NetWeaver Visual ComposerCVE-2026-89110SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration, this could lead to a full compromise of
• 9.1CriticalOct 13, 2026SAP Manufacturing Integration and Intelligence (Configuration Service) Auth bypass / access controlCVE-2026-89108SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account with elevated privileges on the underlying
• 9.9CriticalOct 13, 2026SAP S/4HANA (Manage Substitution/Validation Rules) Code / command injectionCVE-2026-89107SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could submit specially crafted input, which is interprete
• 4.4MediumOct 13, 2026SAPUI5CVE-2026-89106SAP UI5 does not perform sufficient input validation under certain configurations. An attacker with low privileges could submit specially crafted content that is later rendered in a victim's browser. This vulnerability has a low impact on confidentiality and integrity. There is no impact on availabi
• 5.4MediumOct 13, 2026SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML) XSSCVE-2026-76976Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize user-supplied content in certain functionality, allowing an authenticated attacker to send malicious content to another user. If the victim interacts with the affected content, malicious scri
• 6.1MediumOct 13, 2026SAPUI5 (Support Assistant Overlay) XSSCVE-2026-76975Due to a DOM-Based Cross-Site Scripting (XSS) vulnerability, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated user accesses this link, client-side code reads the attacker-controlled input and writes it into the DOM without proper saniti
• 6.5MediumOct 13, 2026SAP Manufacturing Integration and Intelligence XSSCVE-2026-76972Due to a Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could store malicious content that is later rendered by the application. If an authenticated victim accesses a page that displays this stored content, the injected input is processed duri
• 7.5HighOct 13, 2026SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager) Memory corruptionCVE-2026-58249SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the affected process to crash. Successful ex
• 3.5LowOct 13, 2026SAP Cloud Connector Memory corruptionCVE-2026-58242SAP Cloud Connector contains an improper authorization check, which could be exploited by a low-privileged attacker through specially crafted requests. Exploitation requires the attacker to be on an adjacent network. Successful exploitation could allow the attacker to obtain limited information abou
• 9.8CriticalSep 8, 2026SAP NetWeaver (Message Server)CVE-2026-58240SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unauthorized component and potentially perfor
• 10.0CriticalSep 8, 2026SAP Extended Passport (EPP) Processing Memory corruptionCVE-2026-44756A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditions, an unauthenticated attacker could exploit a crafted network request containing a malformed EPP header, potentially resulting in undefined behavior and abnormal program terminat1.4% likely
• 8.8HighAug 11, 2026SAP ABAP Developer Tools Auth bypass / access controlCVE-2026-58243SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database operations against SAP NetWeaver AS ABAP. Successful exploitation could allow the attacker to read sensitive data, modify application data, and disrupt access for legitimate users, resulting in high impact on confidentiality, integrity, and availability.
• 4.2MediumAug 11, 2026SAP NetWeaver and ABAP Platform (Change and Transport System - Customer Transport Integration Wizard Auth bypass / access controlCVE-2026-58241SAP NetWeaver and ABAP Platform (Change and Transport System - Customer Transport Integration Wizard) allows a low-privileged user to modify configuration tables that control access to data objects during specific operations. These unauthorized modifications could result in processing delays and operational disruption, leading to a low impact on the integrity and availability of the application with no impact on confidentiality.
• 5.5MediumAug 11, 2026SAP NetWeaver Application Server ABAP and ABAP Platform Code / command injectionCVE-2026-58236SAP NetWeaver Application Server ABAP and ABAP Platform allow an attacker with high privileges to bypass missing security controls on an internal code path leading to operating system command execution. Successful exploitation could allow the attacker to execute OS-level commands that write to the operating system or stop the SAP system, resulting in no impact on confidentiality, low impact on integrity, and high impact on availability.
• 6.3MediumAug 11, 2026SAP NetWeaver AS Java (Adobe Document Services) Crypto / certificateCVE-2026-58235SAP NetWeaver Application Server Java (Adobe Document Service) uses outdated open source cryptographic and data transfer libraries that contain known vulnerabilities addressed in later versions. A low-privileged authenticated attacker could potentially leverage these weaknesses against the affected component, though no specific exploit is currently known. Successful exploitation could result in low impact on confidentiality, integrity, and availability of the system.
• 7.3HighAug 11, 2026SAP Manufacturing Integration and Intelligence Auth bypass / access controlCVE-2026-44765Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated remote attacker could access scheduling-related application functions without proper authorization validation. Successful exploitation could allow the attacker to retrieve, create, modify, or delete application-managed scheduling data, causing a low impact on confidentiality, integrity, and availability.
• 7.3HighAug 11, 2026SAP Manufacturing Integration and Intelligence Auth bypass / access controlCVE-2026-44764Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated attacker could send crafted requests to the Cost Servlet using specific parameter values. If processed by the application, these requests enable access to backend operations. Successful exploitation could allow the attacker to read, create, modify, or delete application-managed business data, resulting in a limited impact on the confidentiality, integrity, and availability of
• 7.6HighAug 11, 2026SAP Manufacturing Integration and Intelligence Path traversal / file handlingCVE-2026-44763SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially crafted input. Exploitation also requires a legitimate user to subsequently access the attacker-influenced content and depends on conditions outside the attacker�s control. Successful exploitation could allow files to be written outside the intended directory and affect other components, resulting in a high impact on confidentiality, integr
• 3.7LowAug 11, 2026SAP Data Services Management ConsoleCVE-2026-44762SAP Data Services Management Console allows an overly permissive Content Security Policy (CSP) configuration and lacks certain restrictive directives, which could enable an authenticated malicious user to leverage this weakness in combination with another vulnerability to inject and execute malicious scripts within the application's context. Successful exploitation may result in a low impact on confidentiality and integrity, with no impact on the availability of the application.
• 9.1CriticalAug 11, 2026SAP Manufacturing Integration and Intelligence Code / command injectionCVE-2026-44758SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to submit specially crafted input to certain affected functionality, which is processed without sufficient validation. Successful exploitation could allow the attacker to execute arbitrary commands on the underlying operating system, resulting in high impact on confidentiality, integrity, and availability of the application.
• 5.3MediumAug 11, 2026SAPSPrint Service Memory corruptionCVE-2026-40130SAP SAPSPrint Service has memory corruption vulnerabilities in the handling of certain commands. An unauthenticated attacker could send specially crafted requests that trigger a buffer overflow in the affected component. This causes a temporary service interruption and automatic restart, resulting in low impact on availability but no impact on confidentiality and integrity.
• 9.8CriticalAug 11, 2026SAP NetWeaver and ABAP Platform Memory corruptionCVE-2026-34265SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corruption. This vulnerability could potentially disclose sensitive system information or crash the system, leading to a high impact on the confidentiality, integrity, and availability of the application.
• 6.4MediumMar 10, 2026SAP NetWeaver Application Server for ABAP SSRFCVE-2026-24316SAP NetWeaver Application Server for ABAP provides an ABAP Report for testing purposes, which allows to send HTTP requests to arbitrary internal or external endpoints. The report is therefore vulnerable to Server-Side Request Forgery (SSRF). Successful exploitation could lead to interaction with pot
• 6.1MediumSep 9, 2025SAP NetWeaver ABAP Platform XSSCVE-2025-42938Due to a Cross-Site Scripting (XSS) vulnerability in the SAP NetWeaver ABAP Platform, an unauthenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated user clicks on this link, the injected input is processed during the website�s page generation, resul

See every SAP SE entry on the dashboard.

Top products

• SAP Manufacturing Integration and Intelligence5 CVEs in the last year, 1 critical
• SAP NetWeaver Enterprise Portal3 CVEs in the last year
• SAPUI5 (Support Assistant Overlay)1 CVE in the last year
• SAPUI51 CVE in the last year
• SAPSPrint Service1 CVE in the last year
• SAP S/4HANA (Manage Substitution/Validation Rules)1 CVE in the last year, 1 critical
• SAP S/4HANA (Linear Asset Management RAP Business Object)1 CVE in the last year
• SAP NetWeaver Visual Composer1 CVE in the last year, 1 critical
• SAP NetWeaver AS Java (Adobe Document Services)1 CVE in the last year
• SAP NetWeaver Application Server for ABAP1 CVE in the last year

Advisories

Official advisories from the last 90 days that name this vendor's CVEs.

• SAP · Oct 13, 2026SAP Note 3810872: [ CVE-2026-89124 ] Missing Authorization Check in SAP Global Trade Services, edition for SAP HANA (Display Product Catalog Based on Customs Declaration) Product - SAP HANA (Display Product Catalog Based on Customs Declaration) Version(s) - GTSCORE 200, 300CVE-2026-89124
• SAP · Oct 13, 2026SAP Note 3797111: [ CVE-2026-89110 ] Broken Access Control in SAP NetWeaver Visual Composer Product - SAP NetWeaver Visual Composer Version(s) - VC70RUNTIME 7.50CVE-2026-89110
• SAP · Oct 13, 2026SAP Note 3767634: [ CVE-2026-58242 ] Improper Authorization check in SAP Cloud Connector Product - SAP Cloud Connector Version(s) - SAP_CLOUD_CONNECTOR 2.0CVE-2026-58242
• SAP · Oct 13, 2026SAP Note 3805589: [ CVE-2026-89107 ] Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules) Product - SAP S/4HANA (Manage Substitution/Validation Rules) Version(s) - S4CORE 105, 106, 107, 108, 109CVE-2026-89107
• SAP · Oct 13, 2026SAP Note 3799621: [ CVE-2026-89121 ] Missing Authorization Check in SAP S/4HANA (Linear Asset Management RAP Business Object) Product - SAP S/4HANA (Linear Asset Management RAP Business Object) Version(s) - S4CORE 109CVE-2026-89121
• SAP · Oct 13, 2026SAP Note 3800517: [ CVE-2026-89113 ] SQL Injection vulnerability in SAP Commerce Cloud (OOTB Code) Product - SAP Commerce Cloud (OOTB Code) Version(s) - COM_CLOUD 2211-JDK21CVE-2026-89113
• SAP · Oct 13, 2026SAP Note 3629325: Update to Security Note released on September 2025 Patch Day: [ CVE-2025-42938 ] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver ABAP Platform Product - SAP NetWeaver ABAP Platform Version(s) - S4CRM 100, 200, 204, 205, 206, S4CEXT 107, 108, BBPCRM 713, 714CVE-2025-42938
• SAP · Oct 13, 2026SAP Note 3789825: [ CVE-2026-89118 ] Information Disclosure vulnerability in SAP NetWeaver Enterprise Portal Product - SAP NetWeaver Enterprise Portal Version(s) - EP-RUNTIME 7.50CVE-2026-89118
• SAP · Oct 13, 2026SAP Note 3779985: [ CVE-2026-89117 ] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal Product - SAP NetWeaver Enterprise Portal Version(s) - EP-ADMIN 7.50CVE-2026-89117
• SAP · Oct 13, 2026SAP Note 3765424: [ CVE-2026-58249 ] Memory Corruption vulnerability in SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager) Product - SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager) Version(s) - HDB 2.00, KRNL64UC 7.53, WEBDISP 7.53, 7.54, 7.77, 7.93, 9.16, XSCVE-2026-58249
• SAP · Oct 13, 2026SAP Note 3798788: [ CVE-2026-89108 ] Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configuration Service) Product - SAP Manufacturing Integration and Intelligence (Configuration Service) Version(s) - XMII 15.4, 15.5CVE-2026-89108
• SAP · Oct 13, 2026SAP Note 3671819: [ CVE-2026-76976 ] Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML) Product - SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML) Version(s) - SAP_BASIS 731, SAP_BASIS 740, SAP_BASICVE-2026-76976
• SAP · Oct 13, 2026SAP Note 3799054: [ CVE-2026-89106 ] Cross Site Scripting (XSS) vulnerability in SAPUI5 Product - SAPUI5 Version(s) - SAP_UI 750, 754, 755, 756, 757, 758, 816, UI_700 200CVE-2026-89106
• SAP · Oct 13, 2026SAP Note 3798823: [ CVE-2026-76972 ] Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence Product - SAP Manufacturing Integration and Intelligence Version(s) - XMII 15.4, 15.5CVE-2026-76972
• SAP · Oct 13, 2026SAP Note 3794572: [ CVE-2026-76975 ] Cross-Site Scripting (XSS) vulnerability in SAPUI5 (Support Assistant Overlay) Product - SAPUI5 (Support Assistant Overlay) Version(s) - SAP_UI 754CVE-2026-76975