SAP vulnerabilities
We track 323 vulnerabilities in SAP products across 60+ products. 320 are rated high or critical, and 14 have been exploited in real attacks. The most recent was published on November 10, 2026.
Latest SAP vulnerabilities
- 8.8 High severity
SAP ECC and SAP S/4HANA (IS-OIL): Improper Neutralization of Special Elements used in an OS Command
Due to programming error in function module and report, IS-OIL component in SAP ECC and SAP S/4HANA allows an authenticated attacker to inject an arbitrary operating system command into an unprotected parameter in a common (default) extension. On successful ex
- 7.2 High severity
SAP Solution Manager (Diagnostic Agent): Improper Encoding or Escaping of Output
SAP Solution Manager (Diagnostics agent) - version 7.20, allows an attacker to tamper with headers in a client request. This misleads SAP Diagnostics Agent to serve poisoned content to the server. On successful exploitation, the attacker can cause a limited im
- 7.5 High severity
SAP BusinessObjects Business Intelligence…: Improper Restriction of Excessive Authentication Attempts
SAP BusinessObjects Business Intelligence Platform - version 420, 430, allows an unauthorized attacker who had hijacked a user session, to be able to bypass the victim’s old password via brute force, due to unrestricted rate limit for password change functiona
- 7.4 High severity
SAP NetWeaver AS ABAP and ABAP Platform: Missing Authentication for Critical Functionality
SAP NetWeaver Application Server ABAP and ABAP Platform - version KRNL64NUC, 7.22, KRNL64NUC 7.22EXT, KRNL64UC 7.22, KRNL64UC 7.22EXT, KRNL64UC 7.53, KERNEL 7.22, KERNEL, 7.53, KERNEL 7.77, KERNEL 7.81, KERNEL 7.85, KERNEL 7.89, KERNEL 7.54, KERNEL 7.92, KERNE
- 9.4 Critical severity
SAP Web Dispatcher: Out-of-bounds Write
The SAP Web Dispatcher - versions WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.85, WEBDISP 7.89, WEBDISP 7.91, WEBDISP 7.92, WEBDISP 7.93, KERNEL 7.53, KERNEL 7.54 KERNEL 7.77, KERNEL 7.85, KERNEL 7.89, KERNEL 7.91, KERNEL 7.92, KERNEL 7.93, KRNL64UC 7.
- 7.3 High severity
SAP S/4HANA (Manage Journal Entry Template): Incorrect Permission Assignment for Critical Resource
When creating a journal entry template in SAP S/4HANA (Manage Journal Entry Template) - versions S4CORE 104, 105, 106, 107, an attacker could intercept the save request and change the template, leading to an impact on confidentiality and integrity of the resou
- 7.1 High severity
SAP SQL Anywhere: Insecure Inherited Permissions
SAP SQL Anywhere - version 17.0, allows an attacker to prevent legitimate users from accessing the service by crashing the service. An attacker with low privileged account and access to the local system can write into the shared memory objects. This can be lev
- 8.1 High severity
SAP NetWeaver (BI CONT ADD ON): Improper Limitation of a Pathname to a Restricted Directory
An attacker with non-administrative authorizations in SAP NetWeaver (BI CONT ADD ON) - versions 707, 737, 747, 757, can exploit a directory traversal flaw to over-write system files. Data from confidential files cannot be read but potentially some OS files can
- 9.4 Critical severity
SAP Web Dispatcher: Inconsistent Interpretation of HTTP Requests
An unauthenticated attacker in SAP Web Dispatcher - versions WEBDISP 7.49, WEBDISP 7.53, WEBDISP 7.54, WEBDISP 7.77, WEBDISP 7.81, WEBDISP 7.85, WEBDISP 7.88, WEBDISP 7.89, WEBDISP 7.90, KERNEL 7.49, KERNEL 7.53, KERNEL 7.54 KERNEL 7.77, KERNEL 7.81, KERNEL 7.
- 8.2 High severity
SAP UI5 Variant Management: Improper Neutralization of Input During Web Page Generation
SAP UI5 Variant Management - versions SAP_UI 750, SAP_UI 754, SAP_UI 755, SAP_UI 756, SAP_UI 757, UI_700 200, does not sufficiently encode user-controlled inputs on reading data from the server, resulting in Stored Cross-Site Scripting (Stored XSS) vulnerabili
- 9.3 Critical severity
SAP GUI for Windows: Exposure of Sensitive Information to an Unauthorized Actor
SAP GUI for Windows - version 7.70, 8.0, allows an unauthorized attacker to gain NTLM authentication information of a victim by tricking it into clicking a prepared shortcut file. Depending on the authorizations of the victim, the attacker can read and modify
- 7.5 High severity
SAP PowerDesigner (Proxy): Out-of-bounds Write
In SAP PowerDesigner (Proxy) - version 16.7, an attacker can send a crafted request from a remote host to the proxy machine and crash the proxy server, due to faulty implementation of memory management causing a memory corruption. This leads to a high impact o
- 9.1 Critical severity
SAP AS NetWeaver JAVA: Missing Authentication for Critical Functionality
In SAP AS NetWeaver JAVA - versions SERVERCORE 7.50, J2EE-FRMW 7.50, CORE-TOOLS 7.50, an unauthenticated attacker can attach to an open interface and make use of an open naming and directory API to instantiate an object which has methods which can be called wi
- 7.6 High severity
SAP BusinessObjects Business Intelligence…: Exposure of Sensitive Information to an Unauthorized Actor
SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker to access sensitive information which is otherwise restricted. On successful exploitation, there could be a high impact on confidentiality, limited impact
- 7.2 High severity
SAP BusinessObjects Intelligence Platform: Exposure of Sensitive Information to an Unauthorized Actor
SAP BusinessObjects Business Intelligence Platform - versions 420, 430, allows an authenticated attacker with administrator privileges to get the login token of any logged-in BI user over the network without any user interaction. The attacker can impersonate a
- 9.8 Critical severity
BusinessObjects Business Intelligence Platform…: Exposure of Sensitive Information to an Unauthorized Actor
An attacker with basic privileges in SAP BusinessObjects Business Intelligence Platform (Promotion Management) - versions 420, 430, can get access to lcmbiar file and further decrypt the file. After this attacker can gain access to BI user’s passwords and depe
- 9.8 Critical severity
Diagnostics Agent (EventLogServiceCollector): Missing Authentication for Critical Functionality
Due to missing authentication and input sanitization of code the EventLogServiceCollector of SAP Diagnostics Agent - version 720, allows an attacker to execute malicious scripts on all connected Diagnostics Agents running on Windows. On successful exploitation
- 8.1 High severity
Diagnostics Agent (OSCommand Bridge): Missing Authentication for Critical Functionality
Due to missing authentication and insufficient input validation, the OSCommand Bridge of SAP Diagnostics Agent - version 720, allows an attacker with deep knowledge of the system to execute scripts on all connected Diagnostics Agents. On successful exploitatio
- 8.7 High severity
Landscape Management: Exposure of Resource to Wrong Sphere
An information disclosure vulnerability exists in SAP Landscape Management - version 3.0, enterprise edition. It allows an authenticated SAP Landscape Management user to obtain privileged access to other systems making those other systems vulnerable to informa
- 7.5 High severity
BusinessObjects Business Intelligence Platform…: Server-Side Request Forgery
In SAP BusinessObjects Business Intelligence Platform - version 420, 430, an attacker can control a malicious BOE server, forcing the application server to connect to its own CMS, leading to a high impact on availability.
- 8.8 High severity
Solution Manager and ABAP managed systems: Improper Control of Generation of Code
An attacker authenticated as a user with a non-administrative role and a common remote execution authorization in SAP Solution Manager and ABAP managed systems (ST-PI) - versions 2088_1_700, 2008_1_710, 740, can use a vulnerable interface to execute an applica
- 9.6 Critical severity
NetWeaver AS for ABAP and ABAP Platform: Improper Limitation of a Pathname to a Restricted Directory
SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker to exploit insufficient validation of path information provided by users, thus exploiting a directory traversal flaw
- 8.1 High severity
NetWeaver AS for ABAP and ABAP Platform…: Improper Limitation of a Pathname to a Restricted Directory
An attacker with non-administrative authorizations can exploit a directory traversal flaw in program SAPRSBRO to over-write system files. In this attack, no data can be read but potentially critical OS files can be over-written making the system unavailable.
- 7.2 High severity
Host Agent (SAPOSCOL): Stack-based Buffer Overflow
SAP Host Agent (SAPOSCOL) - version 7.22, allows an unauthenticated attacker with network access to a server port assigned to the SAP Start Service to submit a crafted request which results in a memory corruption error. This error can be used to reveal but not
- 7.5 High severity
BusinessObjects Business Intelligence Platform…: Server-Side Request Forgery
In SAP BusinessObjects Business Intelligence Platform (Web Services) - versions 420, 430, an attacker can control a malicious BOE server, forcing the application server to connect to its own admintools, leading to a high impact on availability.
- 9.6 Critical severity
NetWeaver Application Server for ABAP and ABAP…: Improper Limitation of a Pathname to a Restricted Directory
SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, allows an attacker with non-administrative authorizations to exploit a directory traversal flaw in an available service
- 7.4 High severity
NetWeaver AS for ABAP and ABAP Platform: Server-Side Request Forgery
Due to improper input controls In SAP NetWeaver AS for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, an attacker authenticated as a non-administrative user can craft a request which will trigger the app
- 8.8 High severity
Business Objects (Adaptive Job Server): Improper Neutralization of Special Elements used in an OS Command
SAP Business Object (Adaptive Job Server) - versions 420, 430, allows remote execution of arbitrary commands on Unix, when program objects execution is enabled, to authenticated users with scheduling rights, using the BI Launchpad, Central Management Console o
- 8.8 High severity
Business Objects Business Intelligence…: Improper Neutralization of Special Elements in Output Used by a Downstream Component
In some scenario, SAP Business Objects Business Intelligence Platform (CMC) - versions 420, 430, Program Object execution can lead to code injection vulnerability which could allow an attacker to gain access to resources that are allowed by extra privileges. S
- 8.6 High severity
NetWeaver AS for Java: Improper Authentication
Due to missing authentication check, SAP NetWeaver AS for Java - version 7.50, allows an unauthenticated attacker to attach to an open interface and make use of an open naming and directory API to access services which can be used to perform unauthorized opera
- 9.1 Critical severity
BusinessObjects Business Intelligence Platform…: Unrestricted Upload of File with Dangerous Type
SAP BusinessObjects Business Intelligence Platform (CMC) - versions 420, 430, allows an authenticated admin user to upload malicious code that can be executed by the application over the network. On successful exploitation, attacker can perform operations that
- 8.8 High severity
Host Agent Service: Exposure of Resource to Wrong Sphere
An attacker authenticated as a non-admin user with local access to a server port assigned to the SAP Host Agent (Start Service) - versions 7.21, 7.22, can submit a crafted ConfigureOutsideDiscovery request with an operating system command which will be execute
- 7.1 High severity
SAP BusinessObjects Business Intelligence…: Exposure of Sensitive Information to an Unauthorized Actor
SAP BusinessObjects Business Intelligence platform - versions 420, 430, allows an authenticated attacker to access sensitive information which is otherwise restricted. On successful exploitation, there could be a high impact on confidentiality and limited impa
- 8.8 High severity
BusinessObjects Business Intelligence platform…: Improper Control of Generation of Code
SAP BusinessObjects Business Intelligence Analysis edition for OLAP allows an authenticated attacker to inject malicious code that can be executed by the application over the network. On successful exploitation, an attacker can perform operations that may comp
- 9.8 Critical severity
NetWeaver AS for Java: Improper Access Control
An unauthenticated attacker in SAP NetWeaver AS for Java - version 7.50, due to improper access control, can attach to an open interface and make use of an open naming and directory API to access services which can be used to perform unauthorized operations af
- 8.8 High severity
SAP BPC MS 10.0: Improper Neutralization of Special Elements used in an SQL Command
SAP BPC MS 10.0 - version 810, allows an unauthorized attacker to execute crafted database queries. The exploitation of this issue could lead to SQL injection vulnerability and could allow an attacker to access, modify, and/or delete data from the backend data
- 9.8 Critical severity
NetWeaver ABAP Server and ABAP Platform: Authentication Bypass by Capture-replay
SAP NetWeaver ABAP Server and ABAP Platform - versions SAP_BASIS 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, KERNEL 7.22, 7.53, 7.77, 7.81, 7.85, 7.89, KRNL64UC 7.22, 7.22EXT, 7.53, KRNL64NUC 7.22, 7.22EXT, creates informati
- 8.6 High severity
NetWeaver Process Integration: Missing Authorization
An unauthenticated attacker over the network can attach to an open interface exposed through JNDI by the User Defined Search (UDS) of SAP NetWeaver Process Integration (PI) - version 7.50 and make use of an open naming and directory API to access services whic
- 9.4 Critical severity
NetWeaver Process Integration: Missing Authorization
An unauthenticated user can attach to an open interface exposed through JNDI by the Messaging System of SAP NetWeaver Process Integration (PI) - version 7.50. This user can make use of an open naming and directory API to access services that could perform unau
- 7.5 High severity
Business Planning and Consolidation: Improper Privilege Management
In some SAP standard roles in SAP Business Planning and Consolidation - versions - SAP_BW 750, 751, 752, 753, 754, 755, 756, 757, DWCORE 200, 300, CPMBPC 810, a transaction code reserved for the customer is used. By implementing such transaction code, a malici