CyberSecBulletin

SAP vulnerabilities

We track 323 vulnerabilities in SAP products across 60+ products. 320 are rated high or critical, and 14 have been exploited in real attacks. The most recent was published on November 10, 2026.

323vulnerabilities
100critical
220high
14exploited
8.4average CVSS score

Latest SAP vulnerabilities

  • 7.5 High severity

    SAP NetWeaver Directory Traversal Exploited

    CVE-2016-3976SAPEPSS 47.3%

    Directory traversal vulnerability in SAP NetWeaver AS Java 7.1 through 7.5 allows remote attackers to read arbitrary files via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet, aka SAP Security Note 2234971.

  • 5.3 Medium severity

    SAP NetWeaver Information Disclosure Exploited

    CVE-2016-2388SAPEPSS 52.2%

    The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request, aka SAP Security Note 2256846.

  • 9.8 Critical severity

    SAP NetWeaver SQL Injection Exploited

    CVE-2016-2386SAPEPSS 71.5%

    SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors, aka SAP Security Note 2101079.