SAP vulnerabilities
We track 323 vulnerabilities in SAP products across 60+ products. 320 are rated high or critical, and 14 have been exploited in real attacks. The most recent was published on November 10, 2026.
Latest SAP vulnerabilities
- 7.6 High severity
SAP NetWeaver Visual Composer: Improper Limitation of a Pathname to a Restricted Directory
SAP NetWeaver Visual Composer contains a Directory Traversal vulnerability caused by insufficient validation of input paths provided by a high-privileged user. This allows an attacker to read or modify arbitrary files, resulting in a high impact on confidentia
- 7.6 High severity
SAP BusinessObjects Business Intelligence (BI…: Improper Neutralization of Input During Web Page Generation
SAP BusinessObjects Business Intelligence (BI Workspace) allows an unauthenticated attacker to craft and store malicious script within a workspace. When the victim accesses the workspace, the script will execute in their browser enabling the attacker to potent
- 7.7 High severity
SAP Landscape Transformation (PCL Basis): Missing Authorization
Under certain conditions, SAP Landscape Transformation's PCL Basis module does not perform the necessary authorization checks, allowing authenticated users to access restricted functionalities or data. This can lead to a high impact on confidentiality with no
- 8.3 High severity
SAP S/4HANA Cloud Private Edition or on…: Improper Control of Generation of Code
SAP S/4HANA Cloud Private Edition or on Premise (SCM Master Data Layer (MDL)) allows an authenticated attacker with SAP standard authorization to execute a certain function module remotely and replace arbitrary ABAP programs, including SAP standard programs. T
- 7.9 High severity
SAP Business Objects Business Intelligence…: Missing Authorization
Under certain conditions Promotion Management Wizard (PMW) allows an attacker to access information which would otherwise be restricted.This has High impact on Confidentiality with Low impact on Integrity and Availability of the application.
- 9.1 Critical severity
SAP NetWeaver Deserialization Exploited
SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialized, could potentially lead to a compromise of confidentiality, integrity, and availability of the host system.
- 7.5 High severity
SAP Supplier Relationship Management (Live…: Improper Restriction of XML External Entity Reference
The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) allows an unauthenticated attacker to submit an application servlet request with a crafted XML file which when parsed, enables the attacker to access sensitive files and data. This vulnerab
- 9.8 Critical severity
SAP Supplier Relationship Management (Live…: Deserialization of Untrusted Data
The Live Auction Cockpit in SAP Supplier Relationship Management (SRM) uses a deprecated java applet component, which allows an unauthenticated attacker to send malicious payload request in a specific encoding format. The servlet will then decode this maliciou
- 9.8 Critical severity
SAP NetWeaver Unrestricted File Upload Exploited
SAP NetWeaver Visual Composer Metadata Uploader is not protected with a proper authorization, allowing unauthenticated agent to upload potentially malicious executable binaries that could severely harm the host system. This could significantly affect the confi
- 7.1 High severity
SAP BusinessObjects Business Intelligence…: Insecure Inherited Permissions
Due to insecure file permissions in SAP BusinessObjects Business Intelligence Platform, an attacker who has local access to the system could modify files potentially disrupting operations or cause service downtime hence leading to a high impact on integrity an
- 9.9 Critical severity
SAP Landscape Transformation (Analysis Platform): Improper Control of Generation of Code
SAP Landscape Transformation (SLT) allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This
- 9.8 Critical severity
SAP Financial Consolidation: Storage of Sensitive Data in a Mechanism without Access Control
SAP Financial Consolidation allows an unauthenticated attacker to gain unauthorized access to the Admin account. The vulnerability arises due to improper authentication mechanisms, due to which there is high impact on the Confidentiality, Integrity & Availabil
- 7.7 High severity
SAP Capital Yield Tax Management: Path Traversal: '.../...//'
SAP Capital Yield Tax Management has directory traversal vulnerability due to insufficient path validation. This could allow an attacker with low privileges to read files from directory which they don�t have access to, hence causing a high impact on confidenti
- 9.9 Critical severity
SAP S/4HANA (Private Cloud): Improper Control of Generation of Code
SAP S/4HANA allows an attacker with user privileges to exploit a vulnerability in the function module exposed via RFC. This flaw enables the injection of arbitrary ABAP code into the system, bypassing essential authorization checks. This vulnerability effectiv
- 7.7 High severity
SAP NetWeaver and ABAP Platform (Service Data…: Missing Authorization
Due to directory traversal vulnerability, an authorized attacker could gain access to some critical information by using RFC enabled function module. Upon successful exploitation, they could read files from any managed system connected to SAP Solution Manager,
- 8.5 High severity
SAP NetWeaver Application Server ABAP: Improper Control of Generation of Code
In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call (RFC) request to restricted destinations, which can be used to expose credentials for a remote service. These credentials can then be
- 8.8 High severity
SAP Commerce (Swagger UI): Improper Neutralization of Input During Web Page Generation
Due to insufficient input validation, SAP Commerce (Swagger UI) allows an unauthenticated attacker to inject the malicious code from remote sources, which can be leveraged by an attacker to execute a cross-site scripting (XSS) attack. This could lead to a high
- 8.8 High severity
SAP NetWeaver (ABAP Class Builder): Missing Authorization
Due to missing authorization check, SAP NetWeaver (ABAP Class Builder) allows an attacker to gain higher access levels than they should have, resulting in escalation of privileges. On successful exploitation, this could result in disclosure of highly sensitive
- 8.6 High severity
SAP Supplier Relationship Management (Master…: Improper Limitation of a Pathname to a Restricted Directory
SAP Supplier Relationship Management (Master Data Management Catalog) allows an unauthenticated attacker to use a publicly available servlet to download an arbitrary file over the network without any user interaction. This can reveal highly sensitive informati
- 8.1 High severity
SAP Approuter Node.js package: Authentication Bypass by Assumed-Immutable Data
The SAP Approuter Node.js package version v16.7.1 and before is vulnerable to Authentication bypass. When trading an authorization code an attacker can steal the session of the victim by injecting malicious payload causing High impact on confidentiality and in
- 7.1 High severity
SAP HANA extended application services…: URL Redirection to Untrusted Site
The User Account and Authentication service (UAA) for SAP HANA extended application services, advanced model (SAP HANA XS advanced model) allows an unauthenticated attacker to craft a malicious link, that, when clicked by a victim, redirects the browser to a m
- 7.5 High severity
SAP NetWeaver Server ABAP: Observable Response Discrepancy
SAP NetWeaver Server ABAP allows an unauthenticated attacker to exploit a vulnerability that causes the server to respond differently based on the existence of a specified user, potentially revealing sensitive information. This issue does not enable data modif
- 9.9 Critical severity
SAP NetWeaver Application Server for ABAP and…: Improper Authentication
SAP NetWeaver Application Server for ABAP and ABAP Platform allows an authenticated attacker to obtain illegitimate access to the system by exploiting improper authentication checks, resulting in privilege escalation. On successful exploitation, this can resul
- 7.8 High severity
SAPSetup: Uncontrolled Search Path Element
Due to DLL injection vulnerability in SAPSetup, an attacker with either local user privileges or with access to a compromised corporate user�s Windows account could gain higher privileges. With this, he could move laterally within the network and further compr
- 8.8 High severity
SAP NetWeaver AS for ABAP and ABAP Platform…: Incorrect Permission Assignment for Critical Resource
Under certain conditions SAP NetWeaver AS for ABAP and ABAP Platform (Internet Communication Framework) allows an attacker to access restricted information due to weak access controls. This can have a significant impact on the confidentiality, integrity, and a
- 8.8 High severity
SAP NetWeaver AS ABAP and ABAP Platform: Improper Neutralization of Special Elements used in an SQL Command
SAP NetWeaver AS ABAP and ABAP Platform does not check for authorization when a user executes some RFC function modules. This could lead to an attacker with basic user privileges to gain control over the data in Informix database, leading to complete compromis
- 9.1 Critical severity
SAP BusinessObjects Business Intelligence…: Exposure of Sensitive System Information to an Unauthorized Control Sphere
SAP BusinessObjects Business Intelligence Platform allows an unauthenticated attacker to perform session hijacking over the network without any user interaction, due to an information disclosure vulnerability. Attacker can access and modify all the data of the
- 8.5 High severity
SAP NetWeaver Application Server ABAP: Improper Control of Dynamically-Identified Variables
In certain conditions, SAP NetWeaver Application Server ABAP allows an authenticated attacker to craft a Remote Function Call (RFC) request to restricted destinations, which can be used to expose credentials for a remote service. These credentials can then be
- 7.2 High severity
SAP NetWeaver Administrator(System Overview): Server-Side Request Forgery
SAP NetWeaver Administrator(System Overview) allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in Server-Side Request Forgery (SSRF) w
- 9.1 Critical severity
SAP NetWeaver AS for JAVA (Adobe Document…: Server-Side Request Forgery
Adobe Document Service allows an attacker with administrator privileges to send a crafted request from a vulnerable web application. It is usually used to target internal systems behind firewalls that are normally inaccessible to an attacker from the external
- 7.1 High severity
SAP Host Agent: Incorrect Privilege Assignment
An attacker who gains local membership to sapsys group could replace local files usually protected by privileged access. On successful exploitation the attacker could cause high impact on confidentiality and integrity of the application.
- 8.8 High severity
SAP Web Dispatcher: Incomplete Filtering of Special Elements
An unauthenticated attacker can create a malicious link which they can make publicly available. When an authenticated victim clicks on this malicious link, input data will be used by the web site page generation to create content which when executed in the vic
- 8.2 High severity
SAP BEx Web Java Runtime Export Web Service: XML Injection
BEx Web Java Runtime Export Web Service does not sufficiently validate an XML document accepted from an untrusted source. An attacker can retrieve information from the SAP ADS system and exhaust the number of XMLForm service which makes the SAP ADS rendering (
- 9.8 Critical severity
SAP BusinessObjects Business Intelligence…: Missing Authorization
In SAP BusinessObjects Business Intelligence Platform, if Single Signed On is enabled on Enterprise authentication, an unauthorized user can get a logon token using a REST endpoint. The attacker can fully compromise the system resulting in High impact on confi
- 9.1 Critical severity
SAP Commerce Cloud: Exposure of Sensitive Information to an Unauthorized Actor
Some OCC API endpoints in SAP Commerce Cloud allows Personally Identifiable Information (PII) data, such as passwords, email addresses, mobile numbers, coupon codes, and voucher codes, to be included in the request URL as query or path parameters. On successfu
- 7.7 High severity
SAP CRM WebClient UI: Server-Side Request Forgery
SAP CRM (WebClient UI Framework) allows an authenticated attacker to enumerate accessible HTTP endpoints in the internal network by specially crafting HTTP requests. On successful exploitation this can result in information disclosure. It has no impact on inte
- 7.2 High severity
SAP Commerce: Improper Authorization
In SAP Commerce, a user can misuse the forgotten password functionality to gain access to a Composable Storefront B2B site for which early login and registration is activated, without requiring the merchant to approve the account beforehand. If the site is not
- 7.5 High severity
SAP NetWeaver AS Java: Uncontrolled Resource Consumption
Due to unrestricted access to the Meta Model Repository services in SAP NetWeaver AS Java, attackers can perform DoS attacks on the application, which may prevent legitimate users from accessing it. This can result in no impact on confidentiality and integrity
- 8.1 High severity
SAP Financial Consolidation: Improper Neutralization of Input During Web Page Generation
SAP Financial Consolidation allows data to enter a Web application through an untrusted source. These endpoints are exposed over the network and it allows the user to modify the content from the web site. On successful exploitation, an attacker can cause signi
- 9.0 Critical severity
SAP NetWeaver Application server for ABAP and…: Improper Neutralization of Input During Web Page Generation
SAP NetWeaver Application Server for ABAP and ABAP Platform do not sufficiently encode user controlled inputs, resulting in Cross-Site Scripting (XSS) vulnerability. An attacker can control code that is executed within a user’s browser, which could result in m