SAP
14 CVEs in CISA KEV — 3 with confirmed ransomware use
Products
| CVE | Product | CVSS | EPSS | Added | Due | Flags | Description |
|---|---|---|---|---|---|---|---|
CVE-2025-31324 |
NetWeaver | — | 0.9949 | 2025-04-29 | 2025-05-20 | RW | SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file up |
CVE-2025-42999 |
NetWeaver | — | 0.1285 | 2025-05-15 | 2025-06-05 | RW | SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulne |
CVE-2017-12637 |
NetWeaver | — | — | 2025-03-19 | 2025-04-09 | SAP NetWeaver Application Server (AS) Java contains a directory traversal vulner | |
CVE-2019-0344 |
Commerce Cloud | — | — | 2024-09-30 | 2024-10-21 | SAP Commerce Cloud (formerly known as Hybris) contains a deserialization of untr | |
CVE-2022-22536 |
Multiple Products | — | — | 2022-08-18 | 2022-09-08 | SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, AB | |
CVE-2021-38163 |
NetWeaver | — | — | 2022-06-09 | 2022-06-30 | SAP NetWeaver contains a vulnerability that allows unrestricted file upload. | |
CVE-2016-2386 |
NetWeaver | — | — | 2022-06-09 | 2022-06-30 | SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 | |
CVE-2016-2388 |
NetWeaver | — | — | 2022-06-09 | 2022-06-30 | The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote | |
CVE-2018-2380 |
Customer Relationship Management (CRM) | — | — | 2021-11-03 | 2022-05-03 | RW | SAP Customer Relationship Management (CRM) contains a path traversal vulnerabili |
CVE-2010-5326 |
NetWeaver | — | — | 2021-11-03 | 2022-05-03 | SAP NetWeaver Application Server Java Platforms Invoker Servlet does not require | |
CVE-2016-9563 |
NetWeaver | — | — | 2021-11-03 | 2022-05-03 | SAP NetWeaver Application Server Java Platforms contains an unspecified vulnerab | |
CVE-2020-6287 |
NetWeaver | — | — | 2021-11-03 | 2022-05-03 | SAP NetWeaver Application Server Java Platforms contains a missing authenticatio | |
CVE-2020-6207 |
Solution Manager | — | — | 2021-11-03 | 2022-05-03 | SAP Solution Manager User Experience Monitoring contains a missing authenticatio | |
CVE-2016-3976 |
NetWeaver | — | — | 2021-11-03 | 2022-05-03 | SAP NetWeaver Application Server Java Platforms contains a directory traversal v |