Skip to content
OpenAdvisories

Product · SAP_SE

SAP NetWeaver Application Server Java

12 known vulnerabilities.

SAP NetWeaver Application Server Java at a glance

Last 12 months
2
Critical · all time
0
Exploited · all time
0
Public exploit · all time
1
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 1 vulnerability March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202610
Jan 202600
Dec 202500
Nov 202510
Oct 202500
Sep 202510
Aug 202500
Jul 202510
Jun 202500
May 202500
Apr 202500
Mar 202510
Feb 202520
Jan 202510
Dec 202400

Latest advisories

  • High max 9.9
    NCSC-2025-0007 13 CVEs

    Kwetsbaarheden verholpen in SAP producten

    SAP heeft kwetsbaarheden verholpen in SAP, NetWeaver en ABAP.

    SAP_SE SAP
All Critical High Medium Low Exploited only Public exploit

12 results · Feed

  • Low 3.4
    CVE-2026-23686

    CRLF Injection vulnerability in SAP NetWeaver Application Server Java

    Due to a CRLF Injection vulnerability in SAP NetWeaver Application Server Java, an authenticated attacker with administrative access could submit specially crafted content to the application. If processed by the application, this content enables injection of …

    SAP_SE SAP NetWeaver Application Server Java
  • Medium 5.3
    CVE-2025-42919

    Information Disclosure vulnerability in SAP NetWeaver Application Server Java

    Due to an Information Disclosure vulnerability in SAP NetWeaver Application Server Java, internal metadata files could be accessed via manipulated URLs. An unauthenticated attacker could exploit this vulnerability by inserting arbitrary path components in the…

    SAP_SE SAP NetWeaver Application Server Java
  • Medium 5.3
    CVE-2025-42926

    Missing Authentication check in SAP NetWeaver Application Server Java

    SAP NetWeaver Application Server Java does not perform an authentication check when an attacker attempts to access internal files within the web application.Upon successfully exploitation, an unauthenticated attacker could access these files to gather additio…

    SAP_SE SAP NetWeaver Application Server Java
  • Low 3.5
    CVE-2025-42978

    Insufficiently Secure Hostname Verification for Outbound TLS Connections in SAP NetWeaver Application Server Java

    The widely used component that establishes outbound TLS connections in SAP NetWeaver Application Server Java does not reliably match the hostname that is used for the connection against the wildcard hostname defined in the received certificate of remote TLS s…

    SAP_SE SAP NetWeaver Application Server Java
  • Medium 5.4
    CVE-2025-27431

    Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java

    User management functionality in SAP NetWeaver Application Server Java is vulnerable to Stored Cross-Site Scripting (XSS). This could enable an attacker to inject malicious payload that gets stored and executed when a user accesses the functionality, hence le…

    SAP_SE SAP NetWeaver Application Server Java
  • Medium 4.3
    CVE-2025-24869

    Information Disclosure vulnerability in SAP NetWeaver Application Server Java

    SAP NetWeaver Application Server Java allows an attacker to access an endpoint that can disclose information about deployed server components, including their XML definitions. This information should ideally be restricted to customer administrators, even thou…

    SAP_SE SAP NetWeaver Application Server Java
  • Medium 5.4
    CVE-2025-0054 Public exploit

    Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java

    SAP NetWeaver Application Server Java does not sufficiently handle user input, resulting in a stored cross-site scripting vulnerability. The application allows attackers with basic user privileges to store a Javascript payload on the server, which could be la…

    SAP_SE SAP NetWeaver Application Server Java
  • Medium 6.3
    CVE-2025-0067

    Missing Authorization check in SAP NetWeaver Application Server Java

    Due to a missing authorization check on service endpoints in the SAP NetWeaver Application Server Java, an attacker with standard user role can create JCo connection entries, which are used for remote function calls from or to the application server. This cou…

    SAP_SE SAP NetWeaver Application Server Java
  • Unscored —
    CVE-2022-22533

    Due to improper error handling in SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL6…

    SAP_SE SAP NetWeaver Application Server Java
  • Unscored —
    CVE-2022-22532

    In SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53,…

    SAP_SE SAP NetWeaver Application Server Java
  • Medium 4.7
    CVE-2020-6365

    SAP NetWeaver AS Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, 7.50, Start Page allows an unauthenticated remote…

    SAP_SE SAP NetWeaver Application Server Java
  • Medium 6.1
    CVE-2020-6319

    SAP NetWeaver Application Server Java, versions - 7.10, 7.11, 7.20, 7.30, 7.31, 7.40, and 7.50 allows an unauthenticate…

    SAP_SE SAP NetWeaver Application Server Java