SAP vulnerabilities
We track 323 vulnerabilities in SAP products across 60+ products. 320 are rated high or critical, and 14 have been exploited in real attacks. The most recent was published on November 10, 2026.
Latest SAP vulnerabilities
- 7.5 High severity
SAP Cloud SDK for Python: Improper Limitation of a Pathname to a Restricted Directory
The agent_memory module accepts a caller-supplied tenant parameter in create_client(tenant=...). Prior to version 0.50.0, the tenant parameter was not validated before being used to construct filesystem paths for secret resolution. A value containing path trav
- 7.5 High severity
SAP Cloud SDK for AI(JavaScript): Generation of Error Message Containing Sensitive Information
SAP Cloud SDK for AI (Node.js) could inadvertently include sensitive authentication credentials in error messages generated by certain internal operations under specific failure conditions. An attacker with low privileges and access to application logs or forw
- 10.0 Critical severity
SAP Web Dispatcher: Heap-based Buffer Overflow
SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected functionality. Success
- 9.6 Critical severity
SAP Web Dispatcher and Internet Communication…: Cross-Site Request Forgery
SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient request validation in certain administrative functionality. In the context of Application Server ABAP and SAP Web Dispatcher, an unauthentic
- 7.5 High severity
SAP NetWeaver AS Java EDM Application: Missing Authorization
SAP NetWeaver AS Java EDM Application does not perform an authentication check for certain web service requests. An unauthenticated attacker could send a specially crafted request to retrieve sensitive business information. This results in a high impact on con
- 10.0 Critical severity
SAP Gateway: Incorrect Authorization
SAP Gateway activates the default Access Control List with high privileges allowing categorization of external attacker as internal application server. As a result an unauthenticated attacker with network access to the SAP Gateway could exploit this weakness t
- 7.5 High severity
SAP NetWeaver and ABAP Platform (SAP Message…: Integer Overflow or Wraparound
Due to a Memory Corruption vulnerability in Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted network requests to the affected service. By triggering the vulnerability, the attacker could cause
- 7.5 High severity
SAP NetWeaver and ABAP Platform: Out-of-bounds Write
Due to a Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted requests to the application. If processed by the application, these requests could trigger a memor
- 8.9 High severity
SAP NetWeaver and ABAP Platform: Authentication Bypass by Capture-replay
Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker can send a crafted RFC request that exploits logical errors in memory management, leading to memory co
- 9.9 Critical severity
SAP NetWeaver and ABAP Platform: Exposed Dangerous Method or Function
SAP NetWeaver Application Server ABAP and ABAP Platform does not perform necessary authorization checks for certain internal functionality. An attacker with low privileges could invoke affected functionality to execute arbitrary operating system commands on th
- 10.0 Critical severity
SAP NetWeaver AS ABAP (Internet Communication…: Improper Validation of Specified Type of Input
SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger a memory corruption condition in the affected fun
- 10.0 Critical severity
SAP NetWeaver AS ABAP and ABAP Platform (SAML2…: Improper Verification of Cryptographic Signature
SAP NetWeaver AS ABAP and ABAP Platform does not perform sufficient verification of incoming authentication assertions under certain configurations. An unauthenticated attacker could submit specially crafted data to bypass authentication and impersonate arbitr
- 7.5 High severity
SAP Host Agent: Uncontrolled Search Path Element
SAP Host Agent does not sufficiently validate certain inputs. Under certain condition, an attacker with low privileges could abuse the affected functionality to influence an internal component into loading a malicious file under a privileged account. Successfu
- 7.6 High severity
SAP Web Dispatcher and Internet Communication…: Cross-Site Request Forgery
SAP HANA XSA Web Dispatcher does not perform sufficient request validation in certain administrative functionality. In the context of SAP HANA XSA Web Dispatcher, an unauthenticated attacker could trick a logged-on administrator into visiting a malicious link.
- 7.5 High severity
SAP NetWeaver Application Server (SAP Message…: Incorrect Calculation of Buffer Size
SAP NetWeaver Application Server (SAP Message Server) does not properly size memory allocations when handling certain HTTP requests. An unauthenticated attacker could send a specially crafted request to trigger a heap buffer overflow in affected functionality.
- 7.2 High severity
SAP ABAP Developer Tools (AMDP Data Preview): Improper Control of Generation of Code
SAP ABAP Developer Tools (AMDP Data Preview) does not perform sufficient validation and authorization checks within certain affected functionality. An attacker with high privileges could submit specially crafted input to inject and execute arbitrary code on th
- 8.2 High severity
SAP NetWeaver (Internet Graphics Service): Out-of-bounds Write
SAP NetWeaver (Internet Graphics Service) does not sufficiently validate certain input values within incoming requests. An unauthenticated user could send a specially crafted request to trigger an out-of-bounds memory write in a worker process. Successful expl
- 7.5 High severity
SAP NetWeaver (Internet Graphics Service): Integer Overflow or Wraparound
SAP NetWeaver (Internet Graphics Service) does not sufficiently validate certain input values within incoming requests. An unauthenticated user could send a specially crafted request causing the affected process to read beyond the declared values, resulting in
- 7.5 High severity
SAP NetWeaver (Internet Graphics Service): Out-of-bounds Read
SAP NetWeaver (Internet Graphics Service) does not sufficiently validate certain input values within incoming requests. An unauthenticated user could send a specially crafted request containing malformed image data, triggering an integer overflow that leads to
- 7.5 High severity
SAP NetWeaver (SAP Message Server): Use of Uninitialized Resource
SAP Message Server does not properly handle certain malformed requests, which could be leveraged by an unauthenticated attacker to send specially crafted input. Successful exploitation could allow the attacker to retrieve sensitive information, resulting in a
- 9.9 Critical severity
SAP NetWeaver Knowledge Management (XML Forms): Improper Control of Generation of Code
SAP NetWeaver Knowledge Management (XML Forms) does not sufficiently restrict the selection of XSL transformations processed by the affected functionality. Under certain conditions, an authenticated user with access to the affected functionality could cause an
- 7.7 High severity
SAP Web Dispatcher: Stack-based Buffer Overflow
SAP Web Dispatcher does not sufficiently validate certain inputs during processing, which could lead to memory corruption. An attacker authenticated as a non-administrative user could exploit this vulnerability by providing specially crafted input, causing the
- 7.5 High severity
SAP Cloud SDK for Python: Improper Verification of Cryptographic Signature
The SAP Cloud SDK for Python contains an improper cryptographic signature verification vulnerability (CWE-347) in IASContextProvider, the runtime-context provider registered by default via bootstrap(app).IASContextProvider extracted the app_tid, sap_gtid and u
- 9.1 Critical severity
SAP BusinessObjects Business Intelligence…: Improper Restriction of XML External Entity Reference
SAP BusinessObjects Business Intelligence Platform (Web Intelligence) does not properly restrict external entity resolution when processing OLAP connection requests. An authenticated attacker could exploit this vulnerability to access restricted resources, ena
- 7.1 High severity
SAP/astonish: Insufficient Granularity of Access Control
In SAP/astonish, an authenticated user could potentially identify and operate on another team�s sandbox containers because of improper tenant isolation in the legacy Incus sandbox-management API handlers. The affected handlers did not use the tenant-aware sess
- 9.9 Critical severity
S4CRM: Improper Control of Generation of Code
SAP NetWeaver does not perform necessary authorization checks and lacks sufficient input validation in certain remote-enabled functionality. An attacker with low privileges could send specially crafted input through a remote interface to inject and execute arb
- 7.5 High severity
SAP NetWeaver Application Server ABAP, ABAP…: Loop with Unreachable Exit Condition
SAP NetWeaver Application Server ABAP, ABAP Platform, and SAP Web Dispatcher do not sufficiently handle resource consumption when processing certain requests. An unauthenticated attacker could send specially crafted requests to the affected component, causing
- 7.5 High severity
SAP NetWeaver Application Server ABAP…: Stack-based Buffer Overflow
SAP NetWeaver Application Server ABAP and SAP Web Dispatcher do not sufficiently validate certain header values processed during inbound request handling. An unauthenticated attacker could send a specially crafted request to cause the affected process to becom
- 7.1 High severity
SAP ABAP Platform: Initialization of a Resource with an Insecure Default
A regression caused by an API change in SAP ABAP Platform reintroduces a previously fixed authorization weakness. The session manager can be opened in single transaction mode, including from FLP. A low-privileged attacker could exploit this to bypass restricti
- 8.8 High severity
SAP Commerce Cloud (OOTB Code): Improper Neutralization of Special Elements used in an SQL Command
SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query. An authenticated user could send specially crafted requests to affected functionality to inject arbitrary SQL commands. Successful ex
- 10.0 Critical severity
SAP Cloud: Server-Side Request Forgery
The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications. An attacker who controls the tenant_subdomain parameter can redirect OAuth2 token requests to an attacker-controlled server, causing client credentials
- 9.9 Critical severity
SAP NetWeaver Visual Composer: Exposed Dangerous Method or Function
SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality. An attacker with low privileges could invoke internal operations on a preconfigured remote system. Depending on the remote connection configuration,
- 9.1 Critical severity
SAP Manufacturing Integration and Intelligence…: Missing Authorization
SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain administrative functionality. An attacker with MII administrator privileges could submit a specially crafted request to provision an account wi
- 9.9 Critical severity
SAP S/4HANA (Manage Substitution/Validation…: Improper Control of Generation of Code
SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition functionality that utilizes a domain-specific scripting language. An authenticated attacker with specific business privileges could submit spec
- 7.5 High severity
SAP NetWeaver and SAP Web Dispatcher (Internet…: Integer Underflow (Wrap or Wraparound)
SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by an internal protocol component. An unauthenticated attacker could send a malicious request that triggers a memory-handling error, causing the
- 9.4 Critical severity
SAP Cloud Application Programming Model (CAP): Insufficiently Protected Credentials
@sap/cds-mtxs NPM library does not perform sufficient checks on certain functionality used in multitenant CAP applications with extensibility enabled. An unauthenticated attacker could send specially crafted requests to obtain sensitive credentials and abuse t
- 7.8 High severity
SAP NetWeaver Business Client: Deserialization of Untrusted Data
SAP NetWeaver Business Client does not perform sufficient validation when processing certain locally stored data during application startup. An attacker with low privileges on the local system could replace this data with specially crafted content. When the ap
- 8.5 High severity
SAP Integration Suite: Improper Restriction of XML External Entity Reference
SAP Integration Suite does not sufficiently validate XML documents accepted from untrusted sources in certain internal components. An attacker with low privileges could submit specially crafted XML payloads containing malicious external entity declarations. Su
- 9.0 Critical severity
SAP NetWeaver (SAP GUI for Java): Reliance on Untrusted Inputs in a Security Decision
SAP GUI for Java does not correctly enforce the trust level policy for certain functions invoked from a connected backend system. A low-privileged attacker could exploit this weakness by manipulating a connected backend system to trigger affected functionality
- 7.7 High severity
SAP NetWeaver Application Server for ABAP and…: Integer Underflow (Wrap or Wraparound)
SAP NetWeaver Application Server for ABAP and ABAP Platform allows an unauthenticated user to send a specially crafted packet that triggers reprocessing of a previously buffered user request, potentially hijacking another user's session under narrow timing con