Sage vulnerabilities
We track 14 vulnerabilities in Sage products across 7 products. 14 are rated high or critical, and none are known to be exploited. The most recent was published on September 9, 2026.
Latest Sage vulnerabilities
- 9.0 Critical severity
Sage AR Automation: Missing Authorization
Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Administrative functions do not properly verify user privileges, allowing authenticated low-privileged users to create administrator accounts and obtain elevated privi
- 9.0 Critical severity
Sage AR Automation: Authorization Bypass Through User-Controlled Key
Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Insufficient tenant-level authorization checks allow authenticated users to access administrative resources belonging to other tenants by specifying a valid non predic
- 7.1 High severity
Sage 200 Spain: Authentication Bypass by Capture-replay
SMB forced authentication vulnerability in versions prior to 2025.35.000 of Sage 200 Spain. This vulnerability allows an authenticated attacker with administrator privileges to obtain NTLMv2-SSP Hash by changing any of the paths to a UNC path pointing to a ser
- 7.1 High severity
Sage 200 Spain: Insufficiently Protected Credentials
Pass-Back vulnerability in versions prior to 2025.35.000 of Sage 200 Spain. This vulnerability allows an authenticated attacker with administrator privileges to discover stored SMTP credentials.
- 7.2 High severity
1000: Files or Directories Accessible to External Parties
A file disclosure vulnerability exists in Sage 1000 v7.0.0. This vulnerability allows remote attackers to retrieve arbitrary files from the server's file system by manipulating the URL parameter in HTTP requests. The attacker can exploit this flaw to access se
- 8.1 High severity
1000: Unrestricted Upload of File with Dangerous Type
An Unrestricted File Upload vulnerability exists in Sage 1000 v7.0.0, which allows authorized users to upload files without proper validation. An attacker could exploit this vulnerability by uploading malicious files, such as HTML, scripts, or other executable
- 9.8 Critical severity
Sage 200 Spain: Cleartext Storage of Sensitive Information
Plaintext credential usage vulnerability in Sage 200 Spain 2023.38.001 version, the exploitation of which could allow a remote attacker to extract SQL database credentials from the DLL application. This vulnerability could be linked to known techniques to obta
- 9.8 Critical severity
Sage 300: Use of Hard-coded Credentials
Sage 300 through 2022 uses a hard-coded 40-byte blowfish key to encrypt and decrypt user passwords and SQL connection strings stored in ISAM database files in the shared data directory. This issue could allow attackers to decrypt user passwords and SQL connect
- 7.5 High severity
Sage 300: Use of Hard-coded Credentials
The optional Web Screens feature for Sage 300 through version 2022 uses a hard-coded 40-byte blowfish key ("PASS_KEY") to encrypt and decrypt the database connection string for the PORTAL database found in the "dbconfig.xml". This issue could allow attackers t
- 7.5 High severity
Sage 300: Use of Hard-coded Credentials
The optional Global Search feature for Sage 300 through version 2022 uses a set of hard-coded credentials for the accompanying Apache Solr instance. This issue could allow attackers to login to the Solr dashboard with admin privileges and access sensitive info
- 9.8 Critical severity
Sage 300: Use of Hard-coded Credentials
The optional Web Screens and Global Search features for Sage 300 through version 2022 use a hard-coded 40-byte blowfish key ("LandlordPassKey") to encrypt and decrypt secrets stored in configuration files and in database tables.
- 7.8 High severity
Sage 300: Incorrect Default Permissions
On versions of Sage 300 2017 - 2022 (6.4.x - 6.9.x) which are setup in a "Windows Peer-to-Peer Network" or "Client Server Network" configuration, a low-privileged Sage 300 workstation user could abuse their access to the "SharedData" folder on the connected Sa
- 8.8 High severity
Sage Xrt Business Exchange: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injections in Sage XRT Business Exchange 12.4.302 allow an authenticated attacker to inject malicious data in SQL queries: Add Currencies, Payment Order, and Transfer History.
- 9.0 Critical severity
Sage Enterprise Intelligence: Improper Neutralization of Input During Web Page Generation
Multiple XSS issues were discovered in Sage Enterprise Intelligence 2021 R1.1 that allow an attacker to execute JavaScript code in the context of users' browsers. The attacker needs to be authenticated to reach the vulnerable features. An issue is present in t