SAP vulnerabilities
1,623 CVEs and advisories name SAP as an affected vendor, 8 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-40132Missing Authorization Check in SAP Strategic Enterprise Management (BSP application Balanced Scorecard Wizard)
- CVE-2026-40131SQL Injection vulnerability in SAP HANA Deployment Infrastructure (HDI) deploy library
- CVE-2026-40129Code Injection vulnerability in SAP Application Server ABAP for SAP NetWeaver and ABAP Platform
- CVE-2026-34263Missing authentication check in SAP Commerce cloud configuration
- CVE-2026-34260SQL injection vulnerability in SAP S/4HANA (SAP Enterprise Search for ABAP)
- CVE-2026-34259OS Command Injection Vulnerability in SAP Forecasting & Replenishment
- CVE-2026-34258Content Spoofing vulnerability in SAPUI5 (Search UI)
- CVE-2026-27682Reflected Cross-Site Scripting (XSS) vulnerability in SAP NetWeaver Application Server ABAP (Applications based on Business Server Pages)
- CVE-2026-0502Cross Site Request Forgery (CSRF) in SAP BusinessObjects Business Intelligence Platform
- CVE-2026-34264Information Disclosure vulnerability in SAP Human Capital Management for SAP S/4HANA
- CVE-2026-34262Information Disclosure Vulnerability in SAP HANA Cockpit and HANA Database Explorer
- CVE-2026-34261Missing Authorization check in SAP Business Analytics and SAP Content Management
- CVE-2026-34257Open Redirect vulnerability in SAP NetWeaver Application Server ABAP
- CVE-2026-34256Missing Authorization check in SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise)
- CVE-2026-27683Reflected cross site scripting vulnerability in SAP BusinessObjects Business Intelligence Platform
- CVE-2026-27681SQL Injection vulnerability in SAP Business Planning and Consolidation and SAP Business Warehouse
- CVE-2026-27679Missing Authorization check in SAP S/4HANA Frontend OData Service (Manage Reference Structures)
- CVE-2026-27678Missing Authorization check in SAP S/4HANA Backend OData Service (Manage Reference Structures)
- CVE-2026-27677Missing Authorization check in SAP S/4HANA OData Service (Manage Reference Equipment)
- CVE-2026-27676Missing Authorization check in SAP S/4HANA OData Service (Manage Technical Object Structures)
- CVE-2026-27675Code Injection vulnerability in SAP Landscape Transformation
- CVE-2026-27674Code Injection vulnerability in SAP NetWeaver Application Server Java (Web Dynpro Java)
- CVE-2026-27673Missing Authorization Check in SAP S/4HANA (Private Cloud and On-Premise)
- CVE-2026-27672Missing Authorization check in Material Master Application
- CVE-2026-24318Insecure Session Management vulnerability in SAP BusinessObjects Business Intelligence Platform
- CVE-2026-0512Cross-Site Scripting (XSS) vulnerability in SAP Supplier Relationship Management (SICF Handler in SRM Catalog)
- CVE-2026-27689Denial of service (DOS) in SAP Supply Chain Management
- CVE-2026-27688Missing Authorization check in SAP NetWeaver Application Server for ABAP
- CVE-2026-27687Missing Authorization check in SAP S/4HANA HCM Portugal and SAP ERP HCM Portugal
- CVE-2026-27686Missing Authorization check in SAP Business Warehouse (Service API)