SAP vulnerabilities
We track 323 vulnerabilities in SAP products across 60+ products. 320 are rated high or critical, and 14 have been exploited in real attacks. The most recent was published on November 10, 2026.
Latest SAP vulnerabilities
- 9.8 Critical severity
SAP SQL Anywhere: Stack-based Buffer Overflow
SAP SQL Anywhere - version 17.0, and SAP IQ - version 16.1, allows an attacker to leverage logical errors in memory management to cause a memory corruption, such as Stack-based buffer overflow.
- 7.5 High severity
SAP GRC Access Control Emergency Access…: Improper Authentication
SAP GRC Access control Emergency Access Management allows an authenticated attacker to access a Firefighter session even after it is closed in Firefighter Logon Pad. This attack can be launched only within the firewall. On successful exploitation the attacker
- 7.8 High severity
SAP Business One: Unquoted Search Path or Element
In SAP Business One application when a service is created, the executable path contains spaces and isn’t enclosed within quotes, leading to a vulnerability known as Unquoted Service Path which allows a user to gain SYSTEM privileges. If the service is exploite
- 9.1 Critical severity
SAP Enable Now Manager: Missing Authorization
Due to insecure session management, SAP Enable Now allows an unauthenticated attacker to gain access to user's account. On successful exploitation, an attacker can view or modify user data causing limited impact on confidentiality and integrity of the applicat
- 8.2 High severity
SAP BusinessObjects Business Intelligence…: Cleartext Transmission of Sensitive Information
SAP BusinessObjects Business Intelligence Platform (Open Document) - versions 420, 430, allows an unauthenticated attacker to retrieve sensitive information plain text over the network. On successful exploitation, the attacker can view any data available for a
- 8.1 High severity
SAP SuccessFactors Mobile Application for…: Improper Privilege Management
Due to misconfigured application endpoints, SAP SuccessFactors attachment APIs allow attackers with user privileges to perform activities with admin privileges over the network. These APIs were consumed in the SF Mobile application for Time Off, Time Sheet, EC
- 8.8 High severity
SAP BusinessObjects Business Intelligence…: Cross-Site Request Forgery
SAP BusinessObjects CMC allows an unauthenticated attacker to retrieve token information over the network which would otherwise be restricted. This can be achieved only when a legitimate user accesses the application and a local compromise occurs, like sniffin
- 7.5 High severity
SAP Business one: Improper Restriction of XML External Entity Reference
Due to improper input sanitization of XML input in SAP Business One - version 10.0, an attacker can perform a denial-of-service attack rendering the system temporarily inoperative.
- 7.5 High severity
SAP Business one: Exposure of Resource to Wrong Sphere
Under special integration scenario of SAP Business one and SAP HANA - version 10.0, an attacker can exploit HANA cockpit�s data volume to gain access to highly sensitive information (e.g., high privileged account credentials)
- 8.8 High severity
SAP Business One: Improper Neutralization of Special Elements in Output Used by a Downstream Component
SAP Business One client - version 10.0 allows an attacker with low privileges, to inject code that can be executed by the application. An attacker could thereby control the behavior of the application.
- 7.8 High severity
SAP BusinessObjects (BW Publisher Service): Unquoted Search Path or Element
SAP BusinessObjects BW Publisher Service - versions 420, 430, uses a search path that contains an unquoted element. A local attacker can gain elevated privileges by inserting an executable file in the path of the affected service
- 7.5 High severity
SAP Business One License service API: Missing Authentication for Critical Functionality
Due to missing authentication check, SAP Business one License service API - version 10.0 allows an unauthenticated attacker to send malicious http requests over the network. On successful exploitation, an attacker can break the whole application making it inac
- 8.8 High severity
SAP Financial Consolidation: Missing Authorization
SAP Financial Consolidation - version 1010,�does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
- 7.8 High severity
SAP PowerDesigner Proxy 16.7: Unquoted Search Path or Element
SAP PowerDesigner Proxy - version 16.7, allows an attacker with low privileges and has local access, with the ability to work around system’s root disk access restrictions to Write/Create a program file on system disk root path, which could then be executed wi
- 9.8 Critical severity
SAP NetWeaver and ABAP Platform: Incorrect Authorization
Depending on the configuration of the route permission table in file 'saprouttab', it is possible for an unauthenticated attacker to execute SAProuter administration commands in SAP NetWeaver and ABAP Platform - versions KERNEL 7.49, 7.77, 7.81, 7.85, 7.86, 7.
- 8.8 High severity
SAP NetWeaver Application Server for ABAP and…: Missing Authorization
SAP NetWeaver Application Server for ABAP and ABAP Platform do not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges.
- 7.8 High severity
SAP BusinessObjects Enterprise (Central…: Cleartext Storage of Sensitive Information
During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication credentials are being exposed in Sysmon event logs. This Information Disclosure could cause a high impact on systems’ Confidentiality, Integ
- 7.5 High severity
SAP NetWeaver (Internet Communication Manager): Uncontrolled Recursion
Due to an uncontrolled recursion in SAP Web Dispatcher and SAP Internet Communication Manager, the application may crash, leading to denial of service, but can be restarted automatically.
- 7.5 High severity
SAP NetWeaver (Internet Communication Manager): Out-of-bounds Write
By overlong input values an attacker may force overwrite of the internal program stack in SAP Web Dispatcher - versions 7.53, 7.77, 7.81, 7.85, 7.86, or Internet Communication Manager - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC 7.22, 7.22EXT, 7.49, 7.53
- 8.1 High severity
SAP BusinessObjects Business Intelligence…: Missing XML Validation
When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does not sufficiently validate the XML document accepted from an untrusted source, which might result in arbitrary files retrieval from the server
- 7.5 High severity
SAP NetWeaver Application Server for Java: Missing Authorization
An unauthenticated user can use functions of XML Data Archiving Service of SAP NetWeaver Application Server for Java - version 7.50, to which access should be restricted. This may result in an escalation of privileges.
- 7.5 High severity
SAP BusinessObjects Business Intelligence…: Exposure of Sensitive Information to an Unauthorized Actor
Under certain conditions, SAP BusinessObjects Business Intelligence platform, Client Management Console (CMC) - version 430, allows an attacker to access information which would otherwise be restricted, leading to Information Disclosure.
- 7.5 High severity
SAP Innovation management: Missing Authorization
Under certain conditions, SAP Innovation management - version 2.0, allows an attacker to access information which could lead to information gathering for further exploits and attacks.
- 9.8 Critical severity
SAPCAR - version 7.22, does not contain sufficient input validation on the SAPCAR archive.
SAPCAR - version 7.22, does not contain sufficient input validation on the SAPCAR archive. As a result, the SAPCAR process may crash, and the attacker may obtain privileged access to the system.
- 7.8 High severity
SAP Focused Run (Simple Diagnostics Agent): Missing Authentication for Critical Functionality
The Simple Diagnostics Agent - versions 1.0 up to version 1.57, does not perform any authentication checks for functionalities that can be accessed via localhost on http port 3005. Due to lack of authentication checks, an attacker could access administrative o
- 7.5 High severity
Simple Diagnostics Agent: Exposure of Sensitive Information to an Unauthorized Actor
Simple Diagnostics Agent - versions 1.0 (up to version 1.57.), allows an attacker to access information which would otherwise be restricted via a random port 9000-65535. This allows information gathering which could be used exploit future open-source security
- 7.5 High severity
SAP NetWeaver Application Server for ABAP…: Uncontrolled Resource Consumption
SAP NetWeaver Application Server for ABAP (Kernel) and ABAP Platform (Kernel) - versions KERNEL 7.22, 8.04, 7.49, 7.53, 7.77, 7.81, 7.85, 7.86, 7.87, KRNL64UC 8.04, 7.22, 7.22EXT, 7.49, 7.53, KRNL64NUC 7.22, 7.22EXT, 7.49, does not sufficiently validate sap-pa
- 7.5 High severity
SAP NetWeaver AS ABAP (Workplace Server): Improper Neutralization of Special Elements used in an SQL Command
SAP NetWeaver AS ABAP (Workplace Server) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 787, allows an attacker to execute crafted database queries, that could expose the backend database. Successful attacks could result in disclosure o
- 10.0 Critical severity
SAP Multiple Products HTTP Request Smuggling Exploited
SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server 7.53 and SAP Web Dispatcher are vulnerable for request smuggling and request concatenation. An unauthenticated attacker can prepend a victim's reque
- 7.5 High severity
SAP NetWeaver Application Server Java: Use After Free
Due to improper error handling in SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, an attacker could submit multiple HTTP server requests resulting in errors, such tha
- 9.8 Critical severity
SAP NetWeaver Application Server Java: Inconsistent Interpretation of HTTP Requests
In SAP NetWeaver Application Server Java - versions KRNL64NUC 7.22, 7.22EXT, 7.49, KRNL64UC, 7.22, 7.22EXT, 7.49, 7.53, KERNEL 7.22, 7.49, 7.53, an unauthenticated attacker could submit a crafted HTTP server request which triggers improper shared memory buffer
- 7.8 High severity
SAP Adaptive Server Enterprise: Uncontrolled Search Path Element
SAP Adaptive Server Enterprise (ASE) - version 16.0, installation makes an entry in the system PATH environment variable in Windows platform which, under certain conditions, allows a Standard User to execute malicious Windows binaries which may lead to privile
- 8.8 High severity
SAP NetWeaver Unrestricted File Upload Exploited
SAP NetWeaver (Visual Composer 7.0 RT) versions - 7.30, 7.31, 7.40, 7.50, without restriction, an attacker authenticated as a non-administrative user can upload a malicious file over a network and trigger its processing, which is capable of running operating s
- 10.0 Critical severity
SAP NetWeaver Missing Authentication for Critical Function Exploited
SAP NetWeaver AS JAVA (LM Configuration Wizard), versions - 7.30, 7.31, 7.40, 7.50, does not perform an authentication check which allows an attacker without prior authentication to execute configuration tasks to perform critical actions against the SAP Java s
- 9.8 Critical severity
SAP Solution Manager Missing Authentication for Critical Function Exploited
SAP Solution Manager (User Experience Monitoring), version- 7.2, due to Missing Authentication Check does not perform any authentication for a service resulting in complete compromise of all SMDAgents connected to the Solution Manager.
- 9.8 Critical severity
SAP Commerce Cloud Deserialization of Untrusted Data Exploited
Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to execute arbitrary code on a target machine with 'Hybris' user rights, resulting in Code Injection.
- 6.6 Medium severity
SAP Customer Relationship Management (CRM) Path Traversal Exploited
SAP CRM, 7.01, 7.02,7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing "traverse to parent directory" are passed through to the file APIs.
- 7.5 High severity
SAP NetWeaver Directory Traversal Exploited
Directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS in SAP NetWeaver Application Server Java 7.5 allows remote attackers to read arbitrary files via a .. (dot dot) in the query string, as exploited in the wild in August 201
- 6.5 Medium severity
SAP NetWeaver XML External Entity (XXE) Exploited
BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~tc~bpem~him~uwlconn~provider~web/bpemuwlconn URI, aka SAP Security Note 2296909.
- 10.0 Critical severity
SAP NetWeaver Remote Code Execution Exploited
The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, a