SAP NetWeaver and ABAP Platform vulnerabilities

6 known vulnerabilities in SAP NetWeaver and ABAP Platform from SAP. 6 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  SAP NetWeaver and ABAP Platform: Out-of-bounds Write

  CVE-2026-76970Nov 10, 2026SAP

  Due to a Memory Corruption vulnerability in Application Server ABAP for SAP NetWeaver and ABAP Platform, an unauthenticated attacker could send specially crafted requests to the application. If processed by the application, these requests could trigger a memor

• 8.9 High severity

  SAP NetWeaver and ABAP Platform: Authentication Bypass by Capture-replay

  CVE-2026-76966Nov 10, 2026SAP

  Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker can send a crafted RFC request that exploits logical errors in memory management, leading to memory co

• 9.9 Critical severity

  SAP NetWeaver and ABAP Platform: Exposed Dangerous Method or Function

  CVE-2026-76965Nov 10, 2026SAP

  SAP NetWeaver Application Server ABAP and ABAP Platform does not perform necessary authorization checks for certain internal functionality. An attacker with low privileges could invoke affected functionality to execute arbitrary operating system commands on th

• 9.8 Critical severity

  SAP NetWeaver and ABAP Platform: Out-of-bounds Write

  CVE-2026-34265Aug 11, 2026SAP

  SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corruption. This vulnerability could potentially disclose sensitive system information or crash the system, leading

• 9.8 Critical severity

  SAP NetWeaver and ABAP Platform: Incorrect Authorization

  CVE-2022-27668Jun 14, 2022SAPEPSS 2.2%

  Depending on the configuration of the route permission table in file 'saprouttab', it is possible for an unauthenticated attacker to execute SAProuter administration commands in SAP NetWeaver and ABAP Platform - versions KERNEL 7.49, 7.77, 7.81, 7.85, 7.86, 7.

• 10.0 Critical severity

  SAP Multiple Products HTTP Request Smuggling Exploited

  CVE-2022-22536Feb 9, 2022SAPEPSS 97.9%

  SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's reque