SAP vulnerabilities
We track 323 vulnerabilities in SAP products across 60+ products. 320 are rated high or critical, and 14 have been exploited in real attacks. The most recent was published on November 10, 2026.
Latest SAP vulnerabilities
- 9.6 Critical severity
SAP NetWeaver Application Server ABAP and ABAP…: Unrestricted Upload of File with Dangerous Type
An unauthenticated attacker can upload a malicious file to the server which when accessed by a victim can allow an attacker to completely compromise system.
- 9.3 Critical severity
SAP BusinessObjects Business Intelligence…: Improper Neutralization of Input During Web Page Generation
SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to manipulate a parameter in the Opendocument URL which could lead to high impact on Confidentiality and Integrity of the application
- 7.2 High severity
SAP Asset Accounting: Path Traversal: '.../...//'
SAP Asset Accounting could allow a high privileged attacker to exploit insufficient validation of path information provided by the users and pass it through to the file API's. Thus, causing a considerable impact on confidentiality, integrity and availability o
- 8.8 High severity
SAP NetWeaver AS Java User Management Engine: Weak Password Recovery Mechanism for Forgotten Password
Self-Registration and Modify your own profile in User Admin Application of NetWeaver AS Java does not enforce proper security requirements for the content of the newly defined security answer. This can be leveraged by an attacker to cause profound impact on co
- 9.1 Critical severity
SAP NetWeaver AS Java (Administrator Log…: Improper Neutralization of Special Elements used in a Command
SAP NetWeaver Administrator AS Java (Administrator Log Viewer plug-in) - version 7.50, allows an attacker with high privileges to upload potentially dangerous files which leads to command injection vulnerability. This would enable the attacker to run commands
- 7.6 High severity
SAP Companion: Improper Neutralization of Input During Web Page Generation
SAP Companion - version <3.1.38, has a URL with parameter that could be vulnerable to XSS attack. The attacker could send a malicious link to a user that would possibly allow an attacker to retrieve the sensitive information and cause minor impact on the integ
- 7.4 High severity
SAP Cloud Connector: Improper Certificate Validation
Due to improper validation of certificate in SAP Cloud Connector - version 2.0, attacker can impersonate the genuine servers to interact with SCC breaking the mutual authentication. Hence, the attacker can intercept the request to view/modify sensitive informa
- 7.5 High severity
SAP NetWeaver AS Java (Guided Procedures): Improper Restriction of XML External Entity Reference
SAP NetWeaver AS Java (CAF - Guided Procedures) - version 7.50, allows an unauthenticated attacker to submit a malicious request with a crafted XML file over the network, which when parsed will enable him to access sensitive files and data but not modify them.
- 7.2 High severity
SAP ABA (Application Basis): Improper Control of Generation of Code
In SAP ABA (Application Basis) - versions 700, 701, 702, 731, 740, 750, 751, 752, 75C, 75I, an attacker authenticated as a user with a remote execution authorization can use a vulnerable interface. This allows the attacker to use the interface to invoke an app
- 8.8 High severity
SAP NetWeaver AS Java (User Admin Application): Improper Neutralization of Input During Web Page Generation
The User Admin application of SAP NetWeaver AS for Java - version 7.50, insufficiently validates and improperly encodes the incoming URL parameters before including them into the redirect URL. This results in Cross-Site Scripting (XSS) vulnerability, leading t
- 7.5 High severity
Microsoft Edge browser extension (SAP GUI…: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Under certain conditions the Microsoft Edge browser extension (SAP GUI connector for Microsoft Edge) - version 1.0, allows an attacker to access highly sensitive information which would otherwise be restricted causing high impact on confidentiality.
- 7.5 High severity
SAP NetWeaver (Internet Communication Manager): Exposure of Sensitive System Information to an Unauthorized Control Sphere
Under certain conditions, Internet Communication Manager (ICM) or SAP Web Dispatcher - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22_EXT, WEBDISP 7.22_EXT, WEBDISP 7.53, WEBDISP 7
- 9.1 Critical severity
SAP Application Interface Framework (File…: Improper Control of Generation of Code
In SAP Application Interface Framework File Adapter - version 702, a high privilege user can use a function module to traverse through various layers and execute OS commands directly. By this, such user can control the behaviour of the application. This leads
- 7.2 High severity
SAP LT Replication Server: Incorrect Authorization
SAP LT Replication Server - version S4CORE 103, S4CORE 104, S4CORE 105, S4CORE 106, S4CORE 107, S4CORE 108, does not perform necessary authorization checks. This could allow an attacker with high privileges to perform unintended actions, resulting in escalatio
- 9.8 Critical severity
github.com/sap/cloud-security-client-go: Exposed Dangerous Method or Function
SAP BTP Security Services Integration Library ([Golang] github.com/sap/cloud-security-client-go) - versions < 0.17.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permi
- 7.1 High severity
SAP EMARSYS SDK ANDROID: Incorrect Authorization
Due to lack of proper authorization checks in Emarsys SDK for Android, an attacker can call a particular activity and can forward himself web pages and/or deep links without any validation directly from the host application. On successful attack, an attacker c
- 9.8 Critical severity
sap-xssec: Exposed Dangerous Method or Function
SAP BTP Security Services Integration Library ([Python] sap-xssec) - versions < 4.1.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.
- 9.8 Critical severity
cloud-security-services-integration-library: Exposed Dangerous Method or Function
SAP BTP Security Services Integration Library ([Java] cloud-security-services-integration-library) - versions below 2.17.0 and versions from 3.0.0 to before 3.3.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unaut
- 9.8 Critical severity
@sap/xssec: Exposed Dangerous Method or Function
SAP BTP Security Services Integration Library ([Node.js] @sap/xssec - versions < 3.6.0, allow under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.
- 9.4 Critical severity
SAP NetWeaver Application Server ABAP and ABAP…: Improper Neutralization of Special Elements used in an SQL Command
SAP GUI for Windows and SAP GUI for Java allow an unauthenticated attacker to access information which would otherwise be restricted and confidential. In addition, this vulnerability allows the unauthenticated attacker to write data to a database table. By doi
- 7.3 High severity
SAP GUI for Windows and SAP GUI for Java: Incorrect Permission Assignment for Critical Resource
SAP GUI for Windows and SAP GUI for Java - versions SAP_BASIS 755, SAP_BASIS 756, SAP_BASIS 757, SAP_BASIS 758, allow an unauthenticated attacker to access information which would otherwise be restricted and confidential. In addition, this vulnerability allows
- 8.1 High severity
SAP Commerce Cloud: Weak Password Recovery Mechanism for Forgotten Password
In SAP Commerce Cloud - versions HY_COM 1905, HY_COM 2005, HY_COM2105, HY_COM 2011, HY_COM 2205, COM_CLOUD 2211, a locked B2B user can misuse the forgotten password functionality to un-block his user account again and re-gain access if SAP Commerce Cloud - Com
- 7.6 High severity
Business Objects BI Platform: Improper Neutralization of Input During Web Page Generation
SAP Business Objects Business Intelligence Platform is vulnerable to stored XSS allowing an attacker to upload agnostic documents in the system which when opened by any other user could lead to high impact on integrity of the application.
- 8.0 High severity
SAP Business One: Incorrect Authorization
SAP Business One installation - version 10.0, does not perform proper authentication and authorization checks for SMB shared folder. As a result, any malicious user can read and write to the SMB shared folder. Additionally, the files in the folder can be execu
- 7.5 High severity
SAP PowerDesigner Client: Missing XML Validation
SAP PowerDesigner Client - version 16.7, does not sufficiently validate BPMN2 XML document imported from an untrusted source. As a result, URLs of external entities in BPMN2 file, although not used, would be accessed during import. A successful attack could im
- 7.8 High severity
SAP Privileges: Out-of-bounds Write
An attacker with standard privileges on macOS when requesting administrator privileges from the application can submit input which causes a buffer overflow resulting in a crash of the application. This could make the application unavailable and allow reading o
- 7.1 High severity
SAP BusinessObjects Suite (Installer): Insecure Operation on Windows Junction / Mount Point
SAP BusinessObjects Suite Installer - version 420, 430, allows an attacker within the network to create a directory under temporary directory and link it to a directory with operating system files. On successful exploitation the attacker can delete all the ope
- 9.9 Critical severity
SAP BusinessObjects Business Intelligence…: Incorrect Permission Assignment for Critical Resource
SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, under certain condition allows an authenticated attacker to view sensitive information which is otherwise restricted. On successful exploitation, the attacker can co
- 9.8 Critical severity
SAP CommonCryptoLib: Incorrect Authorization
SAP CommonCryptoLib does not perform necessary authentication checks, which may result in missing or wrong authorization checks for an authenticated user, resulting in escalation of privileges. Depending on the application and the level of privileges acquired,
- 7.3 High severity
SAP BusinessObjects Business Intelligence…: Unrestricted Upload of File with Dangerous Type
Due to insufficient file type validation, SAP BusinessObjects Business Intelligence Platform (Web Intelligence HTML interface) - version 420, allows a report creator to upload files from local system into the report over the network. When uploading the image f
- 7.5 High severity
SAP CommonCryptoLib: Out-of-bounds Write
SAP CommonCryptoLib allows an unauthenticated attacker to craft a request, which when submitted to an open port causes a memory corruption error in a library which in turn causes the target component to crash making it unavailable. There is no ability to view
- 8.1 High severity
CLA Assistant: Missing Authorization
A missing authorization check allows an arbitrary authenticated user to perform certain operations through the API of CLA-assistant by executing specific additional steps. This allows an arbitrary authenticated user to read CLA information including informatio
- 9.8 Critical severity
SAP Commerce: Empty Password in Configuration File
SAP Commerce Cloud may accept an empty passphrase for user ID and passphrase authentication, allowing users to log into the system without a passphrase.
- 8.8 High severity
SAP Message Server: Incorrect Authorization
The ACL (Access Control List) of SAP Message Server - versions KERNEL 7.22, KERNEL 7.53, KERNEL 7.54, KERNEL 7.77, RNL64UC 7.22, RNL64UC 7.22EXT, RNL64UC 7.53, KRNL64NUC 7.22, KRNL64NUC 7.22EXT, can be bypassed in certain conditions, which may enable an authen
- 9.0 Critical severity
SAP BusinessObjects Business Intelligence…: Uncontrolled Search Path Element
SAP Business Objects Installer - versions 420, 430, allows an authenticated attacker within the network to overwrite an executable file created in a temporary directory during the installation process. On replacing this executable with a malicious file, an att
- 7.5 High severity
SAP Commerce (OCC API): Use of Cache Containing Sensitive Information
Under certain conditions SAP Commerce (OCC API) - versions HY_COM 2105, HY_COM 2205, COM_CLOUD 2211, endpoints allow an attacker to access information which would otherwise be restricted. On successful exploitation there could be a high impact on confidentiali
- 9.8 Critical severity
SAP PowerDesigner: Missing Authentication for Critical Functionality
SAP PowerDesigner - version 16.7, has improper access control which might allow an unauthenticated attacker to run arbitrary queries against the back-end database via Proxy.
- 7.8 High severity
SAP PowerDesigner: Improper Control of Generation of Code
SAP SQLA for PowerDesigner 17 bundled with SAP PowerDesigner 16.7 SP06 PL03, allows an attacker with local access to the system, to place a malicious library, that can be executed by the application. An attacker could thereby control the behavior of the applic
- 7.5 High severity
SAP Business One (B1i Layer): Improper Neutralization of Special Elements used in an SQL Command
B1i module of SAP Business One - version 10.0, application allows an authenticated user with deep knowledge to send crafted queries over the network to read or modify the SQL data. On successful exploitation, the attacker can cause high impact on confidentiali
- 7.2 High severity
SAP Solution Manager (Diagnostics agent): Server-Side Request Forgery
SAP Solution Manager (Diagnostics agent) - version 7.20, allows an unauthenticated attacker to blindly execute HTTP requests. On successful exploitation, the attacker can cause a limited impact on confidentiality and availability of the application and other a