SAP vulnerabilities
1,623 CVEs and advisories name SAP as an affected vendor, 8 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-44769SQL Injection vulnerability in SAP S/4HANA Project Management (PPM-PRO)
- CVE-2026-44768Security misconfiguration in SAP WebClient UI
- CVE-2026-44761Insecure Sample Credentials in SAP Commerce Cloud
- CVE-2026-44760Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (applications based on Business Server Pages)
- CVE-2026-44759Cross Site Scripting (XSS) vulnerability in SAP NetWeaver Enterprise Portal
- CVE-2026-44753Information Disclosure vulnerability in SAP HANA Extended Application Services classic model (User Self Service)
- CVE-2026-44752Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server Java(Configuration Wizard)
- CVE-2026-44747Memory Corruption vulnerability in SAP NetWeaver Application Server ABAP
- CVE-2026-44745Open Redirect vulnerability in SAP Approuter
- CVE-2026-27690HTTP Request Smuggling in SAP Approuter
- CVE-2026-0487DLL Hijacking vulnerability in SAProuter on Microsoft Windows
- CVE-2026-44757Cross-Site Scripting (XSS) vulnerability in SAP Wily Introscope Enterprise Manager
- CVE-2026-44755Email Spoofing vulnerability in SAP Business Objects Business Intelligence Platform
- CVE-2026-44754Missing caller identification check-in for ODP Data Replication APIs
- CVE-2026-44751Missing Authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform
- CVE-2026-44750Missing Authorization check in SAP MDG (Review Match Groups Application)
- CVE-2026-44748XML Signature Wrapping in SAML Authentication in SAP NetWeaver AS ABAP and ABAP Platform
- CVE-2026-44746Reflected Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver AS Java (JDBC Test Servlet)
- CVE-2026-44744SQL Injection vulnerability in SAP S/4HANA
- CVE-2026-44743Security Misconfiguration vulnerability in SAP Business Objects
- CVE-2026-40128Directory Traversal vulnerability in SAP NetWeaver Application Server Java (Web Container)
- CVE-2026-27671Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform
- CVE-2026-24315Path Traversal Vulnerability in SAP Fiori (launchpad)
- CVE-2026-44749Information Disclosure vulnerability in SAP Gateway
- CVE-2026-27680CSS Injection vulnerability in SAP NetWeaver Application Server ABAP
- CVE-2026-40137Cross-Site Scripting (XSS) vulnerability in Business Server Pages Application (TAF_APPLAUNCHER)
- CVE-2026-40136Denial of service (DoS) in SAP Financial Consolidation
- CVE-2026-40135OS Command Injection vulnerability in SAP NetWeaver Application Server for ABAP and ABAP Platform
- CVE-2026-40134Missing Authorization Check in SAP Incentive and Commission Management
- CVE-2026-40133Missing Authorization check in SAP S/4HANA Condition Maintenance