SAP security vulnerabilities
ERP. Public CVE monitoring for SAP NetWeaver and SAP S/4HANA. Vendor security advisories are linked on this page.
Built for ERP administrators.
181 public records · 0 security-fix timeline events. 0 published in the last 7 days. 157 store a version range.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 3
- High 2
- Medium 1
- Low 0
2026-08-046 issues2026-11-01
Known exploited
View all known exploited- Medium5.3SAP netweaver_application_server_java Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')Patch nowKEVEPSS 23.68%Jul 14, 2020
- Medium6.1SAP Solution Manager URL Redirection to Untrusted Site ('Open Redirect')Patch nowKEVEPSS 2.20%Dec 9, 2020
- Critical9.9Improper Control of Generation of Code ('Code Injection')Patch nowKEVEPSS 1.65%Aug 12, 2025
- Critical9.1SAP NetWeaver Deserialization VulnerabilityPatch nowKEVEPSS 12.85%Apr 27, 2025
- Critical10.0SAP NetWeaver Unrestricted File Upload VulnerabilityPatch nowKEVEPSS 99.49%Apr 22, 2025
- Critical9.8SAP Commerce Cloud Deserialization of Untrusted Data VulnerabilityPatch nowKEVEPSS 7.47%Aug 14, 2019
- Critical10.0SAP Multiple Products HTTP Request Smuggling VulnerabilityPatch nowKEVEPSS 97.95%Feb 9, 2022
- Critical9.8SAP NetWeaver SQL Injection VulnerabilityPatch nowKEVEPSS 71.52%Feb 16, 2016
Recently published
Browse catalog- High8.8SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database query.Check if you run itEPSS 0.45%Oct 13, 2026
- Critical10.0The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications.Check if you run itEPSS 0.37%Oct 13, 2026
- Critical9.9SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality.Check if you run itEPSS 0.40%Oct 13, 2026
- High7.6SAP Manufacturing Integration and Intelligence allows a privileged attacker to exploit insufficient file path validation in certain functions using specially crafted input.Check if you run itEPSS 0.40%Aug 11, 2026
- Medium5.3SAP SAPSPrint Service has memory corruption vulnerabilities in the handling of certain commands.Check if you run itEPSS 0.47%Aug 11, 2026
- Critical9.8SAP NetWeaver Application Server ABAP allows an unauthenticated attacker to exploit logical errors in DIAG protocol parsing, resulting in memory corruption.Check if you run itEPSS 0.64%Aug 11, 2026
- Medium4.3SAP Financial Consolidation allows an authenticated attacker to disconnect other users by terminating their sessions temporarily preventing access.Check if you run itEPSS 0.29%May 12, 2026
- Medium6.5During authorization checks in SAP Human Capital Management for SAP S/4HANA, the system returns specific messages.Check if you run itEPSS 0.27%Apr 14, 2026
- Medium4.3Information Disclosure Vulnerability in SAP HANA Cockpit and HANA Database ExplorerCheck if you run itEPSS 0.30%Apr 14, 2026
- Medium4.1SAP BusinessObjects Business Intelligence application allows an authenticated attacker to inject malicious JavaScript payloads through crafted URLs.Check if you run itEPSS 0.18%Apr 14, 2026