Skip to content
OpenAdvisories

Product · SAP

SAP NetWeaver Application Server ABAP

14 known vulnerabilities.

SAP NetWeaver Application Server ABAP at a glance

Last 12 months
4
Critical · all time
1
Exploited · all time
0
Public exploit · all time
0
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 1 vulnerability May 2026: 1 vulnerability June 2026: 0 vulnerabilities Jun July 2026: 1 vulnerability, 1 critical August 2026: 1 vulnerability September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202610
Jul 202611
Jun 202600
May 202610
Apr 202610
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202510
Jul 202520
Jun 202500
May 202500
Apr 202510
Mar 202510
Feb 202500
Jan 202510
Dec 202410

Latest advisories

  • High max 8.8
    NCSC-2025-0076 24 CVEs

    Kwetsbaarheden verholpen in SAP software

    SAP heeft meerdere kwetsbaarheden verholpen in zijn softwarecomponenten, waaronder SAP Commerce, SAP NetWeaver, en SAP BusinessObjects.

    SAP
  • High max 9.9
    NCSC-2025-0007 13 CVEs

    Kwetsbaarheden verholpen in SAP producten

    SAP heeft kwetsbaarheden verholpen in SAP, NetWeaver en ABAP.

    SAP
  • High max 9.1
    NCSC-2024-0472 13 CVEs

    Kwetsbaarheden verholpen in SAP producten

    SAP heeft kwetsbaarheden verholpen in SAP NetWeaver, ABAP, Web Dispatcher, Business Objects, HCM en Commerce Cloud.

    SAP
  • High max 9.8
    NCSC-2024-0333 21 CVEs

    Kwetsbaarheden verholpen in SAP producten

    SAP heeft kwetsbaarheden verholpen in diverse producten als SAP Business Objects, SAP HANA, Netweaver en Document Builder.

    SAP
All Critical High Medium Low Exploited only Public exploit

14 results · Feed

  • Medium 6.3
    CVE-2026-66779

    Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP

    Due to a Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP, an authenticated attacker could generate a malicious link and make it publicly accessible. If an authenticated victim accesses this link, the injected input is process…

    SAP SAP NetWeaver Application Server ABAP
  • Critical 9.9
    CVE-2026-44747

    Memory Corruption vulnerability in SAP NetWeaver Application Server ABAP

    SAP NetWeaver Application Server ABAP allows an authenticated attacker to leverage logical errors in memory management to cause a memory corruption that could lead to unauthorized data access, modification, or system unavailability. This has high impact on co…

    SAP SAP NetWeaver Application Server ABAP
  • Low 3.1
    CVE-2026-27680

    CSS Injection vulnerability in SAP NetWeaver Application Server ABAP

    Due to improper input handling under certain conditions, SAP NetWeaver Application Server ABAP allows an attacker to inject custom Cascading Style Sheets (CSS) data into a web page served by the application. When a user accesses or clicks the affected page, t…

    SAP SAP NetWeaver Application Server ABAP
  • Medium 6.1
    CVE-2026-34257

    Open Redirect vulnerability in SAP NetWeaver Application Server ABAP

    Due to an Open Redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft malicious URL that, if accessed by a victim, they could be redirected to the page controlled by the attacker. This causes low impact on con…

    SAP SAP NetWeaver Application Server ABAP
  • Medium 6.1
    CVE-2025-42945

    HTML Injection vulnerability in SAP NetWeaver Application Server ABAP

    SAP NetWeaver Application Server ABAP has HTML injection vulnerability. Due to this, an attacker could craft a URL with malicious script as payload and trick a victim with active user session into executing it. Upon successful exploit, this vulnerability coul…

    SAP SAP NetWeaver Application Server ABAP
  • Medium 6.1
    CVE-2025-42956

    Multiple vulnerabilities in SAP NetWeaver Application Server ABAP

    SAP NetWeaver Application Server ABAP and ABAP Platform allows an unauthenticated attacker to create a malicious link which they can make publicly available. When an authenticated victim clicks on this malicious link, injected input data will be used by the w…

    SAP SAP NetWeaver Application Server ABAP
  • Medium 6.1
    CVE-2025-42981

    Multiple vulnerabilities in SAP NetWeaver Application Server ABAP

    Due to an open redirect vulnerability in SAP NetWeaver Application Server ABAP, an unauthenticated attacker could craft a URL link embedding a malicious script at a location not properly sanitized. When a victim clicks on this link, the script executes within…

    SAP SAP NetWeaver Application Server ABAP
  • High 8.5
    CVE-2025-23186

    Mixed Dynamic RFC Destination vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP

    In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call (RFC) request to restricted destinations, which can be used to expose credentials for a remote service. These credentials can then be…

    SAP SAP NetWeaver Application Server ABAP
  • Medium 6.1
    CVE-2025-25242

    Cross-Site Scripting (XSS) in SAP NetWeaver Application Server ABAP

    SAP NetWeaver Application Server ABAP allows malicious scripts to be executed in the application, potentially leading to a Cross-Site Scripting (XSS) vulnerability. This has no impact on the availability of the application, but it can have some minor impact o…

    SAP SAP NetWeaver Application Server ABAP
  • Medium 4.3
    CVE-2025-0068

    Missing Authorization check in Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP

    An obsolete functionality in SAP NetWeaver Application Server ABAP did not perform necessary authorization checks. Because of this, an authenticated attacker could obtain information that would otherwise be restricted. It has no impact on integrity or availab…

    SAP SAP NetWeaver Application Server ABAP
  • High 8.5
    CVE-2024-54198

    Information Disclosure vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP

    In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call (RFC) request to restricted destinations, which can be used to expose credentials for a remote service. These credentials can then be…

    SAP SAP NetWeaver Application Server ABAP
  • Medium 4.3
    CVE-2024-47593

    Information Disclosure Vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform

    SAP NetWeaver Application Server ABAP allows an unauthenticated attacker with network access to read files from the server, which otherwise would be restricted.This attack is possible only if a Web Dispatcher or some sort of Proxy Server is in use and the fil…

    SAP SAP NetWeaver Application Server ABAP
  • Medium 4.7
    CVE-2024-41732

    Improper Access Control in SAP Netweaver Application Server ABAP

    SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to craft a URL link that could bypass allowlist controls. Depending on the web applications provided by this server, the attacker might inject CSS code or links into the web application …

    SAP SAP NetWeaver Application Server ABAP
  • Unscored —
    CVE-2022-29610

    SAP NetWeaver Application Server ABAP allows an authenticated attacker to upload malicious files and delete (theme) dat…

    SAP SAP NetWeaver Application Server ABAP