SAP vulnerabilities
1,623 CVEs and advisories name SAP as an affected vendor, 8 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2025-27435Information Disclosure Vulnerability in SAP Commerce Cloud
- CVE-2025-27429Code Injection Vulnerability in SAP S/4HANA (Private Cloud or On-Premise)
- CVE-2025-27428Directory Traversal vulnerability in SAP NetWeaver and ABAP Platform (Service Data Collection)
- CVE-2025-26657Information Disclosure vulnerability in SAP KMC WPC
- CVE-2025-26654Potential information disclosure vulnerability in SAP Commerce Cloud (Public Cloud)
- CVE-2025-26653Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML)
- CVE-2025-23186Mixed Dynamic RFC Destination vulnerability through Remote Function Call (RFC) in SAP NetWeaver Application Server ABAP
- CVE-2025-27436Broken Access Control vulnerabilities in SAP S/4HANA (Manage Bank Statements)
- CVE-2025-27434Cross-Site Scripting (XSS) vulnerability in SAP Commerce (Swagger UI)
- CVE-2025-27433Broken Access Control vulnerabilities in SAP S/4HANA (Manage Bank Statements)
- CVE-2025-27432Missing Authorization check in SAP Electronic Invoicing for Brazil (eDocument Cockpit)
- CVE-2025-27431Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java
- CVE-2025-27430Server Side Request Forgery (SSRF) in SAP CRM and SAP S/4 HANA (Interaction Center)
- CVE-2025-26661Missing Authorization check in SAP NetWeaver (ABAP Class Builder)
- CVE-2025-26660Broken Access Control in SAP Fiori apps (Posting Library)
- CVE-2025-26659Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on SAP GUI for HTML)
- CVE-2025-26658Broken Authentication in SAP Business One (Service Layer)
- CVE-2025-26656Missing Authorization check in S/4HANA (Manage Purchasing Info Records)
- CVE-2025-26655Missing Authorization check in SAP JIT(Outbound)
- CVE-2025-25245Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)
- CVE-2025-25244Missing Authorization Check in SAP Business Warehouse (Process Chains)
- CVE-2025-25242Cross-Site Scripting (XSS) in SAP NetWeaver Application Server ABAP
- CVE-2025-23194Missing Authentication check in SAP NetWeaver Enterprise Portal (OBN component)
- CVE-2025-23188Missing Authorization check in SAP S/4HANA (RBD)
- CVE-2025-23185Information Disclosure in SAP Business Objects Business Intelligence Platform
- CVE-2025-0071Information Disclosure vulnerability in SAP Web Dispatcher and Internet Communication Manager
- CVE-2025-0062Cross-Site Scripting (XSS) vulnerability in SAP BusinessObjects Business Intelligence Platform (Web Intelligence)
- CVE-2025-25243Path traversal vulnerability in SAP Supplier Relationship Management (Master Data Management Catalog)
- CVE-2025-25241Missing Authorization check in SAP Fiori Apps Reference Library (My Overtime Requests)
- CVE-2025-24876Authentication bypass via authorization code injection in SAP Approuter