SAP vulnerabilities
1,623 CVEs and advisories name SAP as an affected vendor, 8 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-89129Server-Side Request Forgery in SAP NetWeaver AS Java (Web Services)
- CVE-2026-89128Broken Access Control in SAP NetWeaver AS Java (Process Integration Test Tool)
- CVE-2026-89126Memory Corruption vulnerability in SAP Web Dispatcher
- CVE-2026-89119Cross-Site Request Forgery (CSRF) vulnerability in SAP Web Dispatcher and Internet Communication Manager
- CVE-2026-89115Information Disclosure vulnerability in SAP Start Service and SAP Microsoft Management Console
- CVE-2026-89114Missing Authentication check in SAP NetWeaver AS Java EDM Application
- CVE-2026-89103Broken Access Control in SAP Gateway
- CVE-2026-76973Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform (SAP Message Server)
- CVE-2026-76970Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform
- CVE-2026-76966Multiple vulnerabilities in Application Server ABAP of SAP NetWeaver and ABAP Platform
- CVE-2026-76965OS Command Injection vulnerability in ABAP Application Server for SAP NetWeaver and ABAP Platform
- CVE-2026-76964Memory Corruption Vulnerability in SAP NetWeaver AS ABAP (Internet Communication Manager)
- CVE-2026-89124Missing Authorization Check in SAP Global Trade Services, edition for SAP HANA (Display Product Catalog Based on Customs Declaration)
- CVE-2026-89122Open Redirect Vulnerability in SAP NetWeaver Enterprise Portal
- CVE-2026-89121Missing Authorization Check in SAP S/4HANA (Linear Asset Management RAP Business Object)
- CVE-2026-89120Missing authorization check in SAP ABAP Platform
- CVE-2026-89118Information Disclosure vulnerability in SAP NetWeaver Enterprise Portal
- CVE-2026-89117Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal
- CVE-2026-89116OS Command Injection in Yeoman-UI / Application Wizard Extension for VS Code
- CVE-2026-89113SQL Injection vulnerability in SAP Commerce Cloud (OOTB Code)
- CVE-2026-89112Broken Access Control in CLA-Assistant � CLA Signature PII Disclosure
- CVE-2026-89111OAuth2 SSRF vulnerability in SAP Cloud SDK for Python
- CVE-2026-89110Broken Access Control in SAP NetWeaver Visual Composer
- CVE-2026-89108Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configuration Service)
- CVE-2026-89107Code Injection vulnerability in SAP S/4HANA (Manage Substitution/Validation Rules)
- CVE-2026-89106Cross Site Scripting (XSS) vulnerability in SAPUI5
- CVE-2026-89105Improper Authentication in HybridTokenAuthenticator of SAP/cloud-security-services-integration-library
- CVE-2026-76976Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML)
- CVE-2026-76975Cross-Site Scripting (XSS) vulnerability in SAPUI5 (Support Assistant Overlay)
- CVE-2026-76972Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence