SAP vulnerabilities
1,623 CVEs and advisories name SAP as an affected vendor, 8 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-27685Insecure Deserialization in SAP NetWeaver Enterprise Portal Administration
- CVE-2026-27684SQL Injection Vulnerability in SAP NetWeaver (Feedback Notification)
- CVE-2026-24317DLL Hijacking vulnerability in SAP GUI for Windows with active GuiXT
- CVE-2026-24316Server-Side Request Forgery (SSRF) in SAP NetWeaver Application Server for ABAP
- CVE-2026-24313Missing Authorization check in SAP Solution Tools Plug-In (ST-PI)
- CVE-2026-24311Insecure Storage Protection vulnerability in SAP Customer Checkout 2.0
- CVE-2026-24310Missing Authorization check in SAP NetWeaver Application Server for ABAP
- CVE-2026-24309Missing Authorization check in SAP NetWeaver Application Server for ABAP
- CVE-2026-0489DOM-based Cross-Site Scripting (XSS) Vulnerability in SAP Business One (Job Service)
- CVE-2026-24314Information Disclosure vulnerability in S/4HANA (Manage Payment Media)
- CVE-2026-24328Open Redirection vulnerability in Business Server Pages Application (TAF_APPLAUNCHER)
- CVE-2026-24327Missing Authorization Check in SAP Strategic Enterprise Management (Balanced Scorecard in BSP Application)
- CVE-2026-24326Missing authorization check in SAP S/4HANA Defense & Security (Disconnected Operations)
- CVE-2026-24325Cross Site Scripting (XSS) vulnerability in SAP BusinessObjects Enterprise (Central Management Console)
- CVE-2026-24324Denial of service (DOS) vulnerability in SAP BusinessObjects Business Intelligence Platform (AdminTools)
- CVE-2026-24323Multiple vulnerabilities in BSP Applications of SAP Document Management System
- CVE-2026-24322Missing Authorization check in SAP Solution Tools Plug-In (ST-PI)
- CVE-2026-24321Information Disclosure vulnerability in SAP Commerce Cloud
- CVE-2026-24320Memory Corruption vulnerability in SAP NetWeaver and ABAP Platform (Application Server ABAP)
- CVE-2026-24319Information Disclosure Vulnerability in SAP Business One (B1 Client Memory Dump Files)
- CVE-2026-24312Missing authorization check in SAP Business Workflow
- CVE-2026-23689Denial of service (DOS) in SAP Supply Chain Management
- CVE-2026-23688Missing Authorization check in SAP Fiori App (Manage Service Entry Sheets - Lean Services)
- CVE-2026-23687XML Signature Wrapping in SAP NetWeaver AS ABAP and ABAP Platform
- CVE-2026-23686CRLF Injection vulnerability in SAP NetWeaver Application Server Java
- CVE-2026-23685Insecure Deserialization vulnerability in SAP NetWeaver (JMS service)
- CVE-2026-23684Race condition vulnerability in SAP Commerce Cloud
- CVE-2026-23681Missing Authorization check in a function module in SAP Support Tools Plug-In
- CVE-2026-0509Missing Authorization check in SAP NetWeaver Application Server ABAP and ABAP Platform
- CVE-2026-0508Open Redirect vulnerability in SAP BusinessObjects Business Intelligence Platform