SAP vulnerabilities
We track 323 vulnerabilities in SAP products across 60+ products. 320 are rated high or critical, and 14 have been exploited in real attacks. The most recent was published on November 10, 2026.
Latest SAP vulnerabilities
- 8.1 High severity
SAP NetWeaver Application Server ABAP and ABAP…: Missing Authorization
Due to a Missing Authorization Check vulnerability in Application Server ABAP and ABAP Platform, an authenticated attacker could misuse an RFC function to execute form routines (FORMs) in the ABAP system. Successful exploitation could allow the attacker to wri
- 9.9 Critical severity
SAP S/4HANA Private Cloud and On-Premise…: Improper Neutralization of Special Elements used in an SQL Command
Due to insufficient input validation in SAP S/4HANA Private Cloud and On-Premise (Financials General Ledger), an authenticated user could execute crafted SQL queries to read, modify, and delete backend database data. This leads to a high impact on the confiden
- 8.8 High severity
SAP Wily Introscope Enterprise Manager…: Improper Control of Generation of Code
Due to the usage of vulnerable third party component in SAP Wily Introscope Enterprise Manager (WorkStation), an unauthenticated attacker could create a malicious JNLP (Java Network Launch Protocol) file accessible by a public facing URL. When a victim clicks
- 7.2 High severity
SAP S/4HANA (Private Cloud and On-Premise): Improper Control of Generation of Code
SAP S/4HANA (Private Cloud and On-Premise) allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code/OS commands into the system, bypassing essential autho
- 8.8 High severity
SAP HANA database: Missing Authentication for Critical Functionality
SAP HANA database is vulnerable to privilege escalation allowing an attacker with valid credentials of any user to switch to another user potentially gaining administrative access. This exploit could result in a total compromise of the system�s confidentiality
- 9.1 Critical severity
SAP Landscape Transformation: Improper Control of Generation of Code
SAP Landscape Transformation allows an attacker with admin privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code/OS commands into the system, bypassing essential authorization check
- 9.1 Critical severity
SAP jConnect - SDK for ASE: Deserialization of Untrusted Data
Under certain conditions, a high privileged user could exploit a deserialization vulnerability in SAP jConnect to launch remote code execution. The system may be vulnerable when specially crafted input is used to exploit the vulnerability resulting in high imp
- 9.9 Critical severity
SAP Solution Manager: Improper Control of Generation of Code
Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when calling a remote-enabled function module. This could provide the attacker with full control of the system hence leading to high impact on confi
- 8.2 High severity
SAP Web Dispatcher and Internet Communication…: Internal Asset Exposed to Unsafe Debug Access Level or State
SAP Web Dispatcher and ICM may expose internal testing interfaces that are not intended for production. If enabled, unauthenticated attackers could exploit them to access diagnostics, send crafted requests, or disrupt services. This vulnerability has a high im
- 7.5 High severity
SAP Web Dispatcher, Internet Communication…: Out-of-bounds Write
SAP Web Dispatcher, Internet Communication Manager (ICM), and SAP Content Server allow an unauthenticated user to exploit logical errors that lead to a memory corruption vulnerability. This results in high impact on the availability with no impact on confident
- 7.1 High severity
SAP S/4 HANA Private Cloud (Financials General…: Asymmetric Resource Consumption (Amplification)
Due to a Missing Authorization Check vulnerability in SAP S/4 HANA Private Cloud (Financials General Ledger), an authenticated attacker with authorization limited to a single company code could read sensitive data and post or modify documents across all compan
- 7.9 High severity
SAP NetWeaver (remote service for Xcelsius): Asymmetric Resource Consumption (Amplification)
SAP NetWeaver remote service for Xcelsius allows an attacker with network access and high privileges to execute arbitrary code on the affected system due to insufficient input validation and improper handling of remote method calls. Exploitation does not requi
- 7.5 High severity
SAP CommonCryptoLib: Out-of-bounds Write
SAP CommonCryptoLib does not perform necessary boundary checks during pre-authentication parsing of manipulated ASN.1 data over the network. This may result in memory corruption followed by an application crash, hence leading to a high impact on availability.
- 10.0 Critical severity
SQL Anywhere Monitor (Non-Gui): Use of Hard-coded Credentials
SQL Anywhere Monitor (Non-GUI) baked credentials into the code,exposing the resources or functionality to unintended users and providing attackers with the possibility of arbitrary code execution.This could cause high impact on confidentiality integrity and av
- 9.9 Critical severity
SAP Solution Manager: Improper Control of Generation of Code
Due to missing input sanitation, SAP Solution Manager allows an authenticated attacker to insert malicious code when calling a remote-enabled function module. This could provide the attacker with full control of the system hence leading to high impact on confi
- 9.8 Critical severity
SAP Print Service: Path Traversal: '.../...//'
SAP Print Service (SAPSprint) performs insufficient validation of path information provided by users. An unauthenticated attacker could traverse to the parent directory and over-write system files causing high impact on confidentiality integrity and availabili
- 9.0 Critical severity
SAP Supplier Relationship Management: Unrestricted Upload of File with Dangerous Type
Due to missing verification of file type or content, SAP Supplier Relationship Management allows an authenticated attacker to upload arbitrary files. These files could include executables which might be downloaded and executed by the user which could host malw
- 9.1 Critical severity
SAP NetWeaver: Execution with Unnecessary Privileges
Due to a missing authentication check in the SAP NetWeaver application on IBM i-series, the application allows high privileged unauthorized users to read, modify, or delete sensitive information, as well as access administrative or privileged functionalities.
- 10.0 Critical severity
SAP Netweaver (RMI-P4): Deserialization of Untrusted Data
Due to a deserialization vulnerability in SAP NetWeaver, an unauthenticated attacker could exploit the system through the RMI-P4 module by submitting malicious payload to an open port. The deserialization of such untrusted Java objects could lead to arbitrary
- 8.8 High severity
SAP Business One (SLD): Insufficiently Protected Credentials
When a user logs in via SAP Business One native client, the SLD backend service fails to enforce proper encryption of certain APIs. This leads to exposure of sensitive credentials within http response body. As a result, it has a high impact on the confidential
- 8.1 High severity
SAP Landscape Transformation Replication Server: Improper Validation of Specified Type of Input
Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables are not protected by an authorization group. This leads to a high impact on integrity and availability
- 9.9 Critical severity
SAP NetWeaver AS Java (Deploy Web Service): Improper Control of Generation of Code
SAP NetWeaver AS Java allows an attacker authenticated as a non-administrative user to use a flaw in an available service to upload an arbitrary file. This file when executed can lead to a full compromise of confidentiality, integrity and availability of the s
- 8.1 High severity
SAP S/4HANA (Private Cloud or On-Premise): Improper Validation of Specified Type of Input
Due to missing input validation, an attacker with high privilege access to ABAP reports could delete the content of arbitrary database tables, if the tables are not protected by an authorization group. This leads to a high impact on integrity and availability
- 8.1 High severity
SAP NetWeaver Application Server ABAP (BIC…: Out-of-bounds Read
SAP NetWeaver Application Server ABAP (BIC Document) allows an authenticated attacker to craft a request that, when submitted to a BIC Document application, could cause a memory corruption error. On successful exploitation, this results in the crash of the tar
- 9.9 Critical severity
SAP S/4HANA (Private Cloud or On-Premise): Improper Control of Generation of Code
SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effectiv
- 8.8 High severity
SAP Business One (SLD): Incorrect Authorization
Due to broken authorization, SAP Business One (SLD) allows an authenticated attacker to gain administrator privileges of a database by invoking the corresponding API.�As a result , it has a high impact on the confidentiality, integrity, and availability of the
- 9.9 Critical severity
SAP Landscape Transformation (Analysis Platform): Improper Control of Generation of Code
SAP Landscape Transformation (SLT) allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This
- 9.1 Critical severity
SAP NetWeaver Enterprise Portal Federated…: Deserialization of Untrusted Data
SAP NetWeaver Enterprise Portal Federated Portal Network is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host
- 9.9 Critical severity
SAP S/4HANA and SAP SCM (Characteristic…: Improper Control of Generation of Code
SAP S/4HANA and SAP SCM Characteristic Propagation has remote code execution vulnerability. This allows an attacker with user level privileges to create a new report with his own code potentially gaining full control of the affected SAP system causing high imp
- 9.1 Critical severity
SAP NetWeaver (XML Data Archiving Service): Deserialization of Untrusted Data
SAP NetWeaver XML Data Archiving Service allows an authenticated attacker with administrative privileges to exploit an insecure Java deserialization vulnerability by sending a specially crafted serialized Java object. This could lead to high impact on confiden
- 9.1 Critical severity
SAP NetWeaver Enterprise Portal Administration: Deserialization of Untrusted Data
SAP NetWeaver Enterprise Portal Administration is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system.
- 9.1 Critical severity
SAP NetWeaver Application Server for Java (Log…: Deserialization of Untrusted Data
A critical vulnerability in SAP NetWeaver Application server for Java Log Viewer enables authenticated administrator users to exploit unsafe Java object deserialization. Successful exploitation can lead to full operating system compromise, granting attackers c
- 8.1 High severity
SAP NetWeaver ABAP Server and ABAP Platform: Use of Single-factor Authentication
An unauthenticated attacker may exploit a scenario where a Hashed Message Authentication Code (HMAC) credential, extracted from a system missing specific security patches, is reused in a replay attack against a different system. Even if the target system is fu
- 8.1 High severity
SAP NetWeaver Application Server for ABAP: Missing Authorization
SAP Netweaver System Configuration does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This could completely compromise the integrity and availability with no impact on confidentiality of the system
- 7.7 High severity
SAP Business Warehouse and SAP Plug-In Basis: Missing Authorization
SAP Business Warehouse and SAP Plug-In Basis allows an authenticated attacker to add fields to arbitrary SAP database tables and/or structures, potentially rendering the system unusable. On successful exploitation, an attacker can render the system unusable by
- 7.5 High severity
SAP MDM Server: Free of Memory not on the Heap
SAP MDM Server Read function allows an attacker to send specially crafted packets which could trigger a memory read access violation in the server process that would then fail and exit unexpectedly causing high impact on availability with no impact on confiden
- 7.5 High severity
SAP MDM Server: Free of Memory not on the Heap
SAP MDM Server ReadString function allows an attacker to send specially crafted packets which could trigger a memory read access violation in the server process that would then fail and exit unexpectedly causing high impact on availability with no impact on co
- 9.6 Critical severity
SAP NetWeaver Application Server for ABAP: Missing Authorization
RFC inbound processing�does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. On successful exploitation the attacker could critically impact both integrity and availability of the application.
- 8.5 High severity
SAP Business Warehouse and SAP Plug-In Basis: Missing Authorization
SAP Business Warehouse and SAP Plug-In Basis allows an authenticated attacker to drop arbitrary SAP database tables, potentially resulting in a loss of data or rendering the system unusable. On successful exploitation, an attacker can completely delete databas
- 8.8 High severity
SAP GRC (AC Plugin): Missing Authorization
SAP GRC allows a non-administrative user to access and initiate transaction which could allow them to modify or control the transmitted system credentials. This causes high impact on confidentiality, integrity and availability of the application.