Vendor
SAP
1,920 known vulnerabilities in products by SAP, 14 of them actively exploited (CISA KEV).
Key figures
1,920
Vulnerabilities
14
Actively exploited (KEV)
3
Used by ransomware
208
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority.
| Severity | CVE | Title | CVSS | Published |
|---|---|---|---|---|
| Critical | CVE-2025-31324 | Missing Authorization check in SAP NetWeaver (Visual Composer development server) In CISA KEVRansomware | 10.0 | |
| Critical | CVE-2025-42999 | Insecure Deserialization in SAP NetWeaver (Visual Composer development server) In CISA KEVRansomware | 9.1 | |
| Critical | CVE-2018-2380 | SAP Customer Relationship Management (CRM) Path Traversal Vulnerability In CISA KEVRansomware | 6.6 | |
| Critical | CVE-2022-22536 | SAP Multiple Products HTTP Request Smuggling Vulnerability In CISA KEV | 10.0 | |
| Critical | CVE-2020-6207 | SAP Solution Manager Missing Authentication for Critical Function Vulnerability In CISA KEV | 10.0 | |
| Critical | CVE-2020-6287 | SAP NetWeaver Missing Authentication for Critical Function Vulnerability In CISA KEV | 10.0 | |
| Critical | CVE-2016-2386 | SAP NetWeaver SQL Injection Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2021-38163 | SAP NetWeaver Unrestricted File Upload Vulnerability In CISA KEV | 9.9 | |
| Critical | CVE-2010-5326 | SAP NetWeaver Remote Code Execution Vulnerability In CISA KEV | 10.0 | |
| Critical | CVE-2019-0344 | SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2017-12637 | SAP NetWeaver Directory Traversal Vulnerability In CISA KEV | 7.5 | |
| Critical | CVE-2016-3976 | SAP NetWeaver Directory Traversal Vulnerability In CISA KEV | 7.5 | |
| Critical | CVE-2016-9563 | SAP NetWeaver XML External Entity (XXE) Vulnerability In CISA KEV | 6.5 | |
| Critical | CVE-2016-2388 | SAP NetWeaver Information Disclosure Vulnerability In CISA KEV | 5.3 | |
| Critical | CVE-2024-41730 | Missing Authentication check in SAP BusinessObjects Business Intelligence Platform | 9.8 | |
| Critical | CVE-2025-42928 | Deserialization Vulnerability in SAP jConnect - SDK for ASE | 9.1 | |
| Critical | CVE-2025-42880 | Code Injection vulnerability in SAP Solution Manager | 9.9 | |
| Critical | CVE-2021-33690 | SAP NetWeaver Development Infrastructure (NWDI): Server-Side Request Forgery (SSRF) | 9.9 | |
| Critical | CVE-2021-21480 | SAP Manufacturing Integration and Intelligence: Privilege Escalation | 9.9 | |
| Critical | CVE-2021-21477 | SAP Commerce: Remote Code Execution | 9.9 | |
| Critical | CVE-2023-28765 | SAP BusinessObjects Business Intelligence Platform (BI Workspace): Exposure of Sensitive Information to an Unauthorized Actor | 9.8 | |
| Critical | CVE-2013-1592 | SAP_SE SAP NetWeaver (Visual Composer development server): Buffer Overflow | 9.8 | |
| Critical | CVE-2023-0017 | Improper access control in SAP NetWeaver AS for Java | 9.4 | |
| Critical | CVE-2015-7241 | SAP_SE SAP NetWeaver (Visual Composer development server): XML External Entity (XXE) | 9.8 | |
| High | CVE-2023-29186 | SAP NetWeaver (BI CONT ADDON): Path Traversal | 8.7 |
News
- October Patch Tuesday roundup: Over 1,400 Microsoft holes to be plugged, including three zero dayscsoonline,
- NCSC-2026-0356 [1.00] [M/H] Kwetsbaarheden verholpen in diverse SAP-productenncsc-nl,
- SAP Patches CVSS 10.0 Kernel Flaw Enabling Unauthenticated Remote Code Executionthehackernews,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 32sans-atrisk-mail,
- Critical SAP Commerce Cloud Vulnerability Exploited 3 Days After Disclosuresecurityweek,
- SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts Days After Patchthehackernews,