News stories · 30d
4
Advisories · 30d
0
Added to KEV · 90d
0
Actively exploited (CISA KEV)
| Added | CVE | Product | Vulnerability | Ransomware |
|---|---|---|---|---|
| 2025-05-15 | CVE-2025-42999 | NetWeaver | SAP NetWeaver Deserialization Vulnerability | Known |
| 2025-04-29 | CVE-2025-31324 | NetWeaver | SAP NetWeaver Unrestricted File Upload Vulnerability | Known |
| 2025-03-19 | CVE-2017-12637 | NetWeaver | SAP NetWeaver Directory Traversal Vulnerability | |
| 2024-09-30 | CVE-2019-0344 | Commerce Cloud | SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability | |
| 2022-08-18 | CVE-2022-22536 | Multiple Products | SAP Multiple Products HTTP Request Smuggling Vulnerability | |
| 2022-06-09 | CVE-2021-38163 | NetWeaver | SAP NetWeaver Unrestricted File Upload Vulnerability | |
| 2022-06-09 | CVE-2016-2386 | NetWeaver | SAP NetWeaver SQL Injection Vulnerability | |
| 2022-06-09 | CVE-2016-2388 | NetWeaver | SAP NetWeaver Information Disclosure Vulnerability | |
| 2021-11-03 | CVE-2018-2380 | Customer Relationship Management (CRM) | SAP Customer Relationship Management (CRM) Path Traversal Vulnerability | Known |
| 2021-11-03 | CVE-2010-5326 | NetWeaver | SAP NetWeaver Remote Code Execution Vulnerability | |
| 2021-11-03 | CVE-2016-9563 | NetWeaver | SAP NetWeaver XML External Entity (XXE) Vulnerability | |
| 2021-11-03 | CVE-2020-6287 | NetWeaver | SAP NetWeaver Missing Authentication for Critical Function Vulnerability | |
| 2021-11-03 | CVE-2020-6207 | Solution Manager | SAP Solution Manager Missing Authentication for Critical Function Vulnerability | |
| 2021-11-03 | CVE-2016-3976 | NetWeaver | SAP NetWeaver Directory Traversal Vulnerability |
Timeline (last 30 days)
- Hackers Exploit D-Link, Ubiquiti and SAP Flaws to Hijack Devices for Proxy Networks — Cybersecurity News, 2026-10-16
- SAP Patches Critical NetWeaver, S/4HANA Vulnerabilities — SecurityWeek, 2026-10-14
- SAP Discloses Critical CVSS 10 Flaw in Cloud SDK for Python Allowing OAuth2 Credential Theft — The Hacker News, 2026-10-13
- SAP warns of maximum severity OAuth2 SSRF security flaw — BleepingComputer, 2026-10-13