Vendor
Sap Se
1,421 known vulnerabilities in products by Sap Se, 8 of them actively exploited (CISA KEV).
Key figures
1,421
Vulnerabilities
8
Actively exploited (KEV)
3
Used by ransomware
158
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority.
| Severity | CVE | Title | CVSS | Published |
|---|---|---|---|---|
| Critical | CVE-2025-31324 | Missing Authorization check in SAP NetWeaver (Visual Composer development server) In CISA KEVRansomware | 10.0 | |
| Critical | CVE-2025-42999 | Insecure Deserialization in SAP NetWeaver (Visual Composer development server) In CISA KEVRansomware | 9.1 | |
| Critical | CVE-2018-2380 | SAP Customer Relationship Management (CRM) Path Traversal Vulnerability In CISA KEVRansomware | 6.6 | |
| Critical | CVE-2022-22536 | SAP Multiple Products HTTP Request Smuggling Vulnerability In CISA KEV | 10.0 | |
| Critical | CVE-2020-6207 | SAP Solution Manager Missing Authentication for Critical Function Vulnerability In CISA KEV | 10.0 | |
| Critical | CVE-2020-6287 | SAP NetWeaver Missing Authentication for Critical Function Vulnerability In CISA KEV | 10.0 | |
| Critical | CVE-2021-38163 | SAP NetWeaver Unrestricted File Upload Vulnerability In CISA KEV | 9.9 | |
| Critical | CVE-2019-0344 | SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability In CISA KEV | 9.8 | |
| Critical | CVE-2024-41730 | Missing Authentication check in SAP BusinessObjects Business Intelligence Platform | 9.8 | |
| Critical | CVE-2025-42928 | Deserialization Vulnerability in SAP jConnect - SDK for ASE | 9.1 | |
| Critical | CVE-2025-42880 | Code Injection vulnerability in SAP Solution Manager | 9.9 | |
| Critical | CVE-2021-33690 | SAP NetWeaver Development Infrastructure (NWDI): Server-Side Request Forgery (SSRF) | 9.9 | |
| Critical | CVE-2021-21480 | SAP Manufacturing Integration and Intelligence: Privilege Escalation | 9.9 | |
| Critical | CVE-2021-21477 | SAP Commerce: Remote Code Execution | 9.9 | |
| Critical | CVE-2025-42944 | Insecure Deserialization vulnerability in SAP Netweaver (RMI-P4) | 10.0 | |
| Critical | CVE-2020-6364 | SAP_SE SAP Wily Introscope Enterprise Manager (WorkStation): Code Injection | 10.0 | |
| Critical | CVE-2023-37483 | Improper Access Control Vulnerabilities in SAP PowerDesigner | 9.8 | |
| Critical | CVE-2019-0285 | SAP Crystal Reports for Visual Studio: security vulnerability | 9.8 | |
| Critical | CVE-2026-44756 | Memory Corruption vulnerability in SAP Extended Passport (EPP) Processing | 10.0 | |
| Critical | CVE-2021-21479 | SAP SCIMono: security vulnerability | 8.1 | |
| Critical | CVE-2020-26829 | SAP NetWeaver AS JAVA (P2P Cluster Communication): Missing Authentication | 10.0 | |
| High | CVE-2018-2392 | SAP Internet Graphics Server: XML External Entity (XXE) | 7.5 | |
| High | CVE-2022-28213 | SAP BusinessObjects Business Intelligence Platform: Missing XML Validation | 8.1 | |
| Critical | CVE-2020-6318 | SAP NetWeaver (ABAP Server) and ABAP Platform: Code Injection | 9.1 | |
| Critical | CVE-2021-21465 | SAP Business Warehouse: SQL Injection | 9.9 |
News
- October Patch Tuesday roundup: Over 1,400 Microsoft holes to be plugged, including three zero dayscsoonline,
- NCSC-2026-0356 [1.00] [M/H] Kwetsbaarheden verholpen in diverse SAP-productenncsc-nl,
- SAP Patches CVSS 10.0 Kernel Flaw Enabling Unauthenticated Remote Code Executionthehackernews,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 32sans-atrisk-mail,
- Critical SAP Commerce Cloud Vulnerability Exploited 3 Days After Disclosuresecurityweek,
- SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts Days After Patchthehackernews,