Skip to content
OpenAdvisories

Vendor

SAP

1,623 known vulnerabilities.

Products

SAP 3D Visual Enterprise Viewer 127 SAP BusinessObjects Business Intelligence Platform 36 SAP 3D Visual Enterprise Author 27 SAP NetWeaver Enterprise Portal 22 SAP Business One 21 SAP NetWeaver Application Server for ABAP and ABAP Platform 18 SAP Enable Now 16 SAP NetWeaver AS ABAP and ABAP Platform 16 SAP NetWeaver Application Server for ABAP 15 SAP Disclosure Management 15 SAP HANA Extended Application Services 15 SAP Business Objects Business Intelligence Platform 15 SAP NetWeaver Application Server ABAP 14 SAP Commerce 14 SAP Commerce Cloud 13 SAP Internet Graphics Server 13 SAP NetWeaver Application Server ABAP and ABAP Platform 13 SAP NetWeaver Application Server Java 12 SAP GUI for Windows 12 SAP Financial Consolidation 11 SAP NetWeaver and ABAP Platform 11 SAP Business AI Platform (Approuter) 11 SAP Web Dispatcher 11 SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) 10 SAP Host Agent 10 SAP CRM (WebClient UI) 10 SAP Cloud Connector 10 SAP NetWeaver AS Java 9 SAP Manufacturing Integration and Intelligence 9 SAP NetWeaver ABAP Server and ABAP Platform 8 SAP Solution Manager 8 SAP HANA 8 SAP Adaptive Server Enterprise 8 SAP HANA database 7 SAP Internet Graphics Service 7 SAP S/4HANA 7 NetWeaver AS for ABAP and ABAP Platform 7 SAP Internet Graphics Server (IGS) 7 SAP Business Connector 7 SAP NetWeaver AS ABAP 7
All Critical High Medium Low Exploited only Public exploit

13 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-76964 Public exploit

    Memory Corruption Vulnerability in SAP NetWeaver AS ABAP (Internet Communication Manager)

    SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected fu…

    SAP SAP NetWeaver AS ABAP (Internet Communication Manager)
  • Critical 10.0
    CVE-2026-58231 Public exploit

    Improper Authorization in SAP Commerce Cloud (Data Hub Adapter)

    SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise …

    SAP SAP Commerce Cloud (Data Hub Adapter)
  • Critical 10.0
    CVE-2025-42944 Public exploit

    Insecure Deserialization vulnerability in SAP Netweaver (RMI-P4)

    Due to a deserialization vulnerability in SAP NetWeaver, an unauthenticated attacker could exploit the system through the RMI-P4 module by submitting malicious payload to an open port. The deserialization of such untrusted Java objects could lead to arbitrary…

    SAP SAP Netweaver (RMI-P4)
  • Critical 9.9
    CVE-2025-42957 Public exploit

    Code Injection vulnerability in SAP S/4HANA (Private Cloud or On-Premise)

    SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effecti…

    SAP SAP S/4HANA (Private Cloud or On-Premise)
  • Critical 10.0
    CVE-2025-31324 Exploited · Ransomware Public exploit Scanner template EPSS 99%

    Missing Authorization check in SAP NetWeaver (Visual Composer development server)

    SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the conf…

    SAP SAP NetWeaver (Visual Composer development server)
    KEV Apr 29, 2025
  • Critical 9.1
    CVE-2024-22127 Public exploit

    Code Injection vulnerability in SAP NetWeaver AS Java (Administrator Log Viewer plug-in)

    SAP NetWeaver Administrator AS Java (Administrator Log Viewer plug-in) - version 7.50, allows an attacker with high privileges to upload potentially dangerous files which leads to command injection vulnerability. This would enable the attacker to run commands…

    SAP SAP NetWeaver AS Java (Administrator Log Viewer plug-in)
  • Critical 9.9
    CVE-2022-41272 Public exploit

    An unauthenticated attacker over the network can attach to an open interface exposed through JNDI by the User Defined S…

    SAP NetWeaver Process Integration
  • Critical 9.8
    CVE-2022-22536 Exploited Public exploit Scanner template EPSS 98%

    SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 an…

    SAP SAP Web Dispatcher SAP NetWeaver and ABAP Platform SAP Content Server
    KEV Aug 18, 2022
  • Critical 9.9
    CVE-2021-33690 Public exploit Scanner template EPSS 69%

    Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure Comp…

    SAP SAP NetWeaver Development Infrastructure (Component Build Service)
  • Critical 9.9
    CVE-2021-38163 Exploited Public exploit EPSS 37%

    SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticate…

    SAP SAP NetWeaver (Visual Composer 7.0 RT)
    KEV Jun 9, 2022
  • Critical 10.0
    CVE-2020-6364 Public exploit

    SAP Solution Manager and SAP Focused Run (update provided in WILY_INTRO_ENTERPRISE 9.7, 10.1, 10.5, 10.7), allows an at…

    SAP SAP Solution Manager (CA Introscope Enterprise Manager) and SAP Focused Run (CA Introscope Enterprise Manager)
  • Critical 10.0
    CVE-2020-6287 Exploited Public exploit Scanner template EPSS 95%

    SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication …

    SAP SAP NetWeaver AS JAVA (LM Configuration Wizard)
    KEV Nov 3, 2021
  • Critical 10.0
    CVE-2020-6207 Exploited Public exploit Scanner template EPSS 98%

    SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform a…

    SAP SAP Solution Manager (User Experience Monitoring)
    KEV Nov 3, 2021