SAP known exploited vulnerabilities
Every SAP CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 14 in all, 0 added in the last 12 months.
- CVE-2025-42999Insecure Deserialization in SAP NetWeaver (Visual Composer development server)SAP_SE SAP NetWeaver
- CVE-2025-31324Missing Authorization check in SAP NetWeaver (Visual Composer development server)SAP_SE SAP NetWeaver
- CVE-2017-12637Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows
- CVE-2019-0344Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possiSAP SE SAP Commerce Cloud
- CVE-2022-22536SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher SAP SE SAP NetWeaver and ABAP Platform · SAP SE SAP Web… +1
- CVE-2021-38163SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administraSAP SE SAP NetWeaver
- CVE-2016-2388The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted
- CVE-2016-2386SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands v
- CVE-2020-6287SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows anSAP SE SAP NetWeaver AS JAVA
- CVE-2020-6207SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication forSAP SE SAP Solution Manager
- CVE-2018-2380SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thuSAP SE SAP CRM
- CVE-2016-9563BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~t
- CVE-2016-3976Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot do
- CVE-2010-5326The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows r
Get alerts for new known exploited vulnerabilities
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/kev/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/kev/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/kev/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/kev/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
https://cve.now/api/v1/entries?filter=kev
Pages of 30 entries, newest first. Pass the response's next_cursor as cursor for the next page.
Frequently asked questions
How many SAP vulnerabilities are in CISA KEV?
14 SAP vulnerabilities are on CISA's Known Exploited Vulnerabilities catalog, 0 of them added in the last 12 months. The newest is CVE-2025-42999 (SAP NetWeaver Deserialization Vulnerability), added 2025-05-15.
Which SAP products are in CISA KEV?
5 products, including NetWeaver, Commerce Cloud, Multiple Products. Attackers have exploited every one of these entries in the wild, and US federal agencies must patch each by its CISA due date.
Are SAP KEV vulnerabilities used by ransomware?
CISA knows ransomware campaigns exploit 3 of the 14 SAP entries.