SAP vulnerabilities
1,623 CVEs and advisories name SAP as an affected vendor, 8 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-120013Path Traversal in Agent Memory Module of SAP Cloud SDK for Python
- CVE-2026-120012Information Disclosure vulnerability in SAP Cloud SDK for AI(JavaScript)
- CVE-2026-109799Improper verification of JWT signature in IASContextProvider leads to tenant/user identity spoofing ( sap-cloud-sdk (pip))
- CVE-2026-109797Cross-tenant sandbox takeover in SAP/astonish
- CVE-2026-109805Weak Cryptography in SAP NetWeaver and ABAP Platform (Application Server ABAP)
- CVE-2026-89125Insecure Storage of Sensitive Information in SAP Web Dispatcher and Internet Communication Manager
- CVE-2026-120017Missing Authentication in SAP NetWeaver AS ABAP and ABAP Platform (SAML2 Service Provider)
- CVE-2026-120016Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Visual Composer
- CVE-2026-120015Insufficient Input Validation in SAP Host Agent
- CVE-2026-120014Cross-Site Request Forgery (CSRF) vulnerability in SAP Web Dispatcher and Internet Communication Manager
- CVE-2026-120010Memory Corruption vulnerability in SAP NetWeaver Application Server (SAP Message Server)
- CVE-2026-120009Code Injection vulnerability in SAP ABAP Developer Tools (AMDP Data Preview)
- CVE-2026-120008Memory Corruption Vulnerability in SAP NetWeaver (Internet Graphics Service)
- CVE-2026-109811Server-Side Request Forgery (SSRF) vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP)
- CVE-2026-109810CSS Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java)
- CVE-2026-109809Security Vulnerabilities SAP NetWeaver Application Server Java (NWDI Cockpit)
- CVE-2026-109808Missing Authorisation Check in SAP Solution Tools Plug-In (ST-PI)
- CVE-2026-109807Multiple Vulnerabilities in SAP NetWeaver (Internet Graphics Service)
- CVE-2026-109806Multiple Vulnerabilities in SAP NetWeaver (Internet Graphics Service)
- CVE-2026-109804Information Disclosure in SAP NetWeaver (SAP Message Server)
- CVE-2026-109803Code Injection vulnerability in SAP NetWeaver Knowledge Management (XML Forms)
- CVE-2026-109802Denial of Service (DoS) vulnerability in SAP NetWeaver Application Server for ABAP
- CVE-2026-109801Security Vulnerabilities SAP NetWeaver Application Server Java (NWDI Cockpit)
- CVE-2026-109800Memory Corruption vulnerability in SAP Web Dispatcher
- CVE-2026-109798XML External Entity (XXE) Vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)
- CVE-2026-109796Multiple vulnerabilities in Application Server ABAP of SAP NetWeaver and ABAP Platform
- CVE-2026-109795Missing authorization check in S4CRM
- CVE-2026-109794Denial of Service vulnerability in SAP NetWeaver Application Server ABAP, ABAP Platform and SAP Web Dispatcher
- CVE-2026-109793Denial of Service (DoS) vulnerability in SAP NetWeaver Application Server ABAP (Internet Communication Manager) and SAP Web Dispatcher
- CVE-2026-89131Cross Site Request Forgery (CSRF) vulnerability in SAP NetWeaver Enterprise Portal