SAP vulnerabilities
We track 323 vulnerabilities in SAP products across 60+ products. 320 are rated high or critical, and 14 have been exploited in real attacks. The most recent was published on November 10, 2026.
Latest SAP vulnerabilities
- 9.8 Critical severity
SAP NetWeaver (Message Server): Use of Single-factor Authentication
SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal application server components during registration. An unauthenticated attacker with network access to the affected service could exploit this weakness to register an unaut
- 10.0 Critical severity
SAP Extended Passport (EPP) Processing: Buffer Copy without Checking Size of Input
A memory safety vulnerability exists in the Extended Passport Protocol (EPP) processing library. Under specific conditions, an unauthenticated attacker could exploit a crafted network request containing a malformed EPP header, potentially resulting in undefine
- 7.5 High severity
SAP S/4HANA (Manage Supply Protection): Inefficient Regular Expression Complexity
SAP S/4HANA (Private Cloud) uses a third-party component that contains a Regular Expression Denial of Service (ReDoS) vulnerability. An unauthenticated attacker could supply specially crafted input that triggers excessive processing within the affected functio
- 10.0 Critical severity
SAP Commerce Cloud (Data Hub Adapter): Improper Control of Generation of Code
SAP Commerce Cloud allows an unauthenticated attacker to abuse a default authentication client and submit specially crafted input to certain functions lacking sufficient validation. Successful exploitation could enable arbitrary code execution and compromise i
- 7.9 High severity
SAP BusinessObjects Business Intelligence…: Use of Hard-coded Cryptographic Key
SAP BusinessObjects Business Intelligence Platform stores certain sensitive credentials associated with user objects using a hard-coded cryptographic key. An attacker with high privileges and local access to the server could retrieve these objects and decrypt
- 8.8 High severity
SAP ABAP Developer Tools: Missing Authorization
SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database operations against SAP NetWeaver AS ABAP. Successful exploitation could allow the at
- 7.0 High severity
SAP Business AI Platform (Approuter): URL Redirection to Untrusted Site
SAP Approuter does not sufficiently validate certain token content under specific configurations. An unauthenticated attacker could send a specially crafted token to cause sensitive credential material to be sent to an attacker-controlled destination. The atta
- 7.3 High severity
SAP Manufacturing Integration and Intelligence: Missing Authorization
Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated remote attacker could access scheduling-related application functions without proper authorization validation. Successful exploitation coul
- 7.3 High severity
SAP Manufacturing Integration and Intelligence: Missing Authorization
Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated attacker could send crafted requests to the Cost Servlet using specific parameter values. If processed by the application, these requests e
- 7.6 High severity
SAP Manufacturing Integration and Intelligence: Improper Limitation of a Pathname to a Restricted Directory
SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially crafted input. Exploitation also requires a legitimate user to subsequently access the attacker-influe
- 9.1 Critical severity
SAP Manufacturing Integration and Intelligence: Improper Control of Generation of Code
SAP Manufacturing Integration and Intelligence (MII) allows an attacker with high privileges to submit specially crafted input to certain affected functionality, which is processed without sufficient validation. Successful exploitation could allow the attacker
- 9.8 Critical severity
SAP NetWeaver and ABAP Platform: Out-of-bounds Write
SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corruption. This vulnerability could potentially disclose sensitive system information or crash the system, leading
- 7.6 High severity
SAP Change and Transport System Attach Tool…: Deserialization of Untrusted Data
SAP Change and Transport System Attach Tool (ctsattach) allows an authenticated attacker to supply a specially crafted archive file which, when processed by the application�s library, can trigger insecure deserialization and lead to remote code execution (RCE)
- 9.1 Critical severity
SAP Commerce Cloud: Use of Default Credentials
SAP Commerce Cloud could retain a sample OAuth2 client with publicly documented sample credentials originating from sample configuration provided in SAP Help Portal documentation. If left unchanged, an unauthenticated attacker could use these well-known creden
- 8.2 High severity
SAP NetWeaver Application Server…: Improper Neutralization of Input During Web Page Generation
SAP NetWeaver Application Server Java allows an unauthenticated attacker to inject malicious JavaScript through crafted URLs. When a victim accesses such a URL, the script executes in the user's browser, allowing the attacker to access sensitive session inform
- 9.9 Critical severity
SAP NetWeaver Application Server ABAP: Out-of-bounds Write
SAP NetWeaver Application Server ABAP allows an authenticated attacker to leverage logical errors in memory management to cause a memory corruption that could lead to unauthorized data access, modification, or system unavailability. This has high impact on con
- 8.1 High severity
SAP Approuter: URL Redirection to Untrusted Site
SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations. This allows an unauthenticated remote attacker to craft a malicious link which, when clicked by a victim, could lead to unauthorized ac
- 9.1 Critical severity
SAP Approuter: Inconsistent Interpretation of HTTP Requests
Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization. This could result in the exposure of user responses and cause the system
- 8.4 High severity
SAProuter on Microsoft Windows: Uncontrolled Search Path Element
SAProuter on Microsoft Windows allows an unauthenticated attacker to load library (DLL) files from an untrusted location, allowing them to execute malicious code on the system. This could enable the attacker to hijack the DLL loading process and achieve arbitr
- 7.1 High severity
SAP NetWeaver AS ABAP and ABAP Platform: Missing Authorization
Application server ABAP does not perform necessary authorization checks for an authenticated user allowing an attacker to execute a report generation command which could overwrite information belonging to another user, resulting in escalation of privileges. Th
- 9.9 Critical severity
SAP NetWeaver AS ABAP and ABAP Platform: Improper Verification of Cryptographic Signature
SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modified signed XML documents to the verifier. This may result in acceptance of tampered identity informat
- 9.0 Critical severity
SAP NetWeaver Application Server Java (Web…: Path Traversal: '.../...//'
SAP NetWeaver Application Server Java (Web Container) allows an unauthenticated attacker to craft a malicious HTTP logon request that manipulates file inclusion parameters, enabling path traversal and processing of the included file. Processing the included fi
- 9.8 Critical severity
SAP NetWeaver AS ABAP and ABAP Platform: Stack-based Buffer Overflow
Due to improper RFC protocol validation in the SAP Kernel used by the Application Server ABAP of SAP NetWeaver and ABAP Platform, an unauthenticated attacker can send a crafted RFC request that exploits logical errors in memory management, leading to memory co
- 9.6 Critical severity
SAP Commerce cloud configuration: Incomplete Cleanup
Due to improper Spring Security configuration, SAP Commerce Cloud allows an unauthenticated user to perform malicious input injection, resulting in arbitrary server-side code execution, leading to high impact on Confidentiality, Integrity, and Availability of
- 9.6 Critical severity
SAP S/4HANA (SAP Enterprise Search for ABAP): Improper Neutralization of Special Elements used in an SQL Command
SAP S/4HANA (SAP Enterprise Search for ABAP) contains a SQL injection vulnerability that allows an authenticated attacker to inject malicious SQL statements through user-controlled input. The application directly concatenates this malicious user input into SQL
- 8.2 High severity
SAP Forecasting & Replenishment: Improper Neutralization of Special Elements used in a Command
Due to an OS Command Execution vulnerability in SAP Forecasting & Replenishment, an authenticated attacker with administrative authorizations could abuse a non-remote-enabled function to execute arbitrary operating system commands. Successful exploitation coul
- 7.1 High severity
SAP ERP and SAP S/4 HANA (Private Cloud and…: Missing Authorization
Due to a missing authorization check in SAP ERP and SAP S/4HANA (Private Cloud and On-Premise), an authenticated attacker could execute a particular ABAP report to overwrite any existing eight?character executable ABAP report without authorization. If the over
- 9.9 Critical severity
SAP Business Planning and Consolidation and…: Improper Neutralization of Special Elements used in an SQL Command
Due to insufficient authorization checks in SAP Business Planning and Consolidation and SAP Business Warehouse, an authenticated user can execute crafted SQL statements to read, modify, and delete database data. This leads to a high impact on the confidentiali
- 7.7 High severity
SAP Supply Chain Management: Unchecked Input for Loop Condition
Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. Th
- 9.1 Critical severity
SAP NetWeaver Enterprise Portal Administration: Deserialization of Untrusted Data
SAP NetWeaver Enterprise Portal Administration is vulnerable if a privileged user uploads untrusted or malicious content that, upon deserialization, could result in a high impact on the confidentiality, integrity, and availability of the host system.
- 7.7 High severity
SAP Solution Tools Plug-In (ST-PI): Missing Authorization
SAP Solution Tools Plug-In (ST-PI) contains a function module that does not perform the necessary authorization checks for authenticated users, allowing sensitive information to be disclosed. This vulnerability has a high impact on confidentiality and does not
- 7.7 High severity
SAP Supply Chain Management: Allocation of Resources Without Limits or Throttling
Due to an uncontrolled resource consumption (Denial of Service) vulnerability, an authenticated attacker with regular user privileges and network access can repeatedly invoke a remote-enabled function module with an excessively large loop-control parameter. Th
- 8.8 High severity
SAP NetWeaver AS ABAP and ABAP Platform: Improper Verification of Cryptographic Signature
SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated attacker with normal privileges to obtain a valid signed message and send modified signed XML documents to the verifier. This may result in acceptance of tampered identity informat
- 9.6 Critical severity
SAP NetWeaver Application Server ABAP and ABAP…: Missing Authorization
SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated, low-privileged user to perform background Remote Function Calls without the required S_RFC authorization in certain cases. This can result in a high impact on integrity and availa
- 8.1 High severity
SAP BusinessObjects Business Intelligence…: URL Redirection to Untrusted Site
The SAP BusinessObjects Business Intelligence Platform allows an authenticated attacker with high privileges to insert malicious URL within the application. Upon successful exploitation, the victim may click on this malicious URL, resulting in an unvalidated r
- 7.5 High severity
SAP BusinessObjects BI Platform: Missing Authorization
SAP BusinessObjects BI Platform allows an unauthenticated attacker to craft a specific network request to the trusted endpoint that breaks the authentication, which prevents the legitimate users from accessing the platform. As a result, it has a high impact on
- 9.9 Critical severity
SAP CRM and SAP S/4HANA (Scripting Editor): Missing Authorization
An authenticated attacker in SAP CRM and SAP S/4HANA (Scripting Editor) could exploit a flaw in a generic function module call and execute unauthorized critical functionalities, which includes the ability to execute an arbitrary SQL statement. This leads to a
- 7.5 High severity
SAP BusinessObjects BI Platform: Asymmetric Resource Consumption (Amplification)
SAP BusinessObjects BI Platform allows an unauthenticated attacker to send specially crafted requests that could cause the Content Management Server (CMS) to crash and automatically restart. By repeatedly submitting these requests, the attacker could induce a
- 8.1 High severity
SAP Fiori App (Intercompany Balance…: Missing Authorization
SAP Fiori App Intercompany Balance Reconciliation does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has high impact on confidentiality and integrity of the application ,availability is not im
- 8.4 High severity
SAP Application Server for ABAP and SAP…: Improper Neutralization of Special Elements used in an OS Command
Due to an OS Command Injection vulnerability in SAP Application Server for ABAP and SAP NetWeaver RFCSDK, an authenticated attacker with administrative access and adjacent network access could upload specially crafted content to the server. If processed by the