netVigilance Vulnerability intelligence since 2004

SAP

14 SAP vulnerabilities with confirmed exploitation in the wild, as published by CISA; 14 past the federal remediation deadline. This is a static slice of the catalog — open the full catalog for search and filters.

Known exploited vulnerabilities for SAP
Vulnerability Status
overdue 462d2025-06-05 CVE-2025-42999 SAP / NetWeaver SAP NetWeaver Deserialization Vulnerability 2025-05-15 9.1 past dueransomware
overdue 478d2025-05-20 CVE-2025-31324 SAP / NetWeaver SAP NetWeaver Unrestricted File Upload Vulnerability 2025-04-29 9.8 past dueransomware
overdue 519d2025-04-09 CVE-2017-12637 SAP / NetWeaver SAP NetWeaver Directory Traversal Vulnerability 2025-03-19 7.5 past due
overdue 689d2024-10-21 CVE-2019-0344 SAP / Commerce Cloud SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability 2024-09-30 9.8 past due
overdue 1463d2022-09-08 CVE-2022-22536 SAP / Multiple Products SAP Multiple Products HTTP Request Smuggling Vulnerability 2022-08-18 10.0 past due
overdue 1533d2022-06-30 CVE-2021-38163 SAP / NetWeaver SAP NetWeaver Unrestricted File Upload Vulnerability 2022-06-09 8.8 past due
overdue 1533d2022-06-30 CVE-2016-2388 SAP / NetWeaver SAP NetWeaver Information Disclosure Vulnerability 2022-06-09 5.3 past due
overdue 1533d2022-06-30 CVE-2016-2386 SAP / NetWeaver SAP NetWeaver SQL Injection Vulnerability 2022-06-09 9.8 past due
overdue 1591d2022-05-03 CVE-2020-6287 SAP / NetWeaver SAP NetWeaver Missing Authentication for Critical Function Vulnerability 2021-11-03 10.0 past due
overdue 1591d2022-05-03 CVE-2020-6207 SAP / Solution Manager SAP Solution Manager Missing Authentication for Critical Function Vulnerability 2021-11-03 9.8 past due
overdue 1591d2022-05-03 CVE-2018-2380 SAP / Customer Relationship Management (CRM) SAP Customer Relationship Management (CRM) Path Traversal Vulnerability 2021-11-03 6.6 past dueransomware
overdue 1591d2022-05-03 CVE-2016-9563 SAP / NetWeaver SAP NetWeaver XML External Entity (XXE) Vulnerability 2021-11-03 6.5 past due
overdue 1591d2022-05-03 CVE-2016-3976 SAP / NetWeaver SAP NetWeaver Directory Traversal Vulnerability 2021-11-03 7.5 past due
overdue 1591d2022-05-03 CVE-2010-5326 SAP / NetWeaver SAP NetWeaver Remote Code Execution Vulnerability 2021-11-03 10.0 past due