SAP vulnerabilities in CISA KEV
SAP has 14 vulnerabilities in CISA's catalogue of flaws known to be exploited, the 20th highest of any vendor. none were added in the last 12 months; 3 are linked to known ransomware use (21.4% of its entries, against 20.4% across the catalogue). CISA's median fix window for these entries is 21 days (range 21 to 181), against 21 days (range 1 to 184) across the whole catalogue. The most exploited product is NetWeaver, with 10 entries. Other frequently affected products: Commerce Cloud (1); Customer Relationship Management (CRM) (1).
Catalog v2026.11.04, released 5 Nov 2026. Source CISA ↗. All KEV entries.
$ ./kev --vendor sap --summary
Counts are computed from the catalog release on ; the 12 month window ends there.
┌─ total entries
14
in CISA KEV
┌─ first added
2021-11-03
earliest entry
┌─ latest added
2025-05-15
most recent entry
┌─ last 12 months
0
entries added
┌─ ransomware use
3 of 14
21.4% linked to ransomware
┌─ distinct products
5
affected products
$ awk -F, {print $1} /var/log/kev/sap.log | uniq -c
Entries by the year CISA added them.
| Year | Entries added | Of which ransomware |
|---|---|---|
| 2021 | 6 | 1 |
| 2022 | 4 | 0 |
| 2024 | 1 | 0 |
| 2025 | 3 | 2 |
$ sort /var/log/kev/sap.log | uniq -c | sort -rn | head -5
The five products with the most entries in the catalogue.
- NetWeaver 10 entries
- Commerce Cloud 1 entry
- Customer Relationship Management (CRM) 1 entry
- Multiple Products 1 entry
- Solution Manager 1 entry
$ kev-due-dates --vendor sap
Days between the date CISA added an entry and the due date it set, median and range. Due dates apply to US federal agencies; for everyone else they are a patch-first ranking signal.
┌─ SAP
21 days (range 21 to 181)
median and range in days
┌─ whole catalogue
21 days (range 1 to 184)
median and range in days
$ grep -o 'CWE-[0-9]*' /var/log/kev/sap.log | sort | uniq -c | sort -rn | head -3
Weakness types CISA records for these entries (13 of 14 have at least one CWE).
$ grep -ril 'SAP' /var/log/news | head -5
Our reporting that names SAP or one of its KEV CVE ids, newest first.
- [INFO] Hackers Use Fake Events to Steal Microsoft and Google Accounts news/fake-events-steal-microsoft-google-accounts.md
Patch Week pages with these entries
No Patch Week page covers this vendor yet.
$ wc -l ./sap.kev · 14 rows
Descriptions: CISA Known Exploited Vulnerabilities catalogue
- CVE-2025-42999
NetWeaver [RANSOMWARE]
SAP NetWeaver Deserialization Vulnerability
due 2025-06-05 · CWE-502
$ cat CVE-2025-42999.txt
Description. SAP NetWeaver Visual Composer Metadata Uploader contains a deserialization vulnerability that allows a privileged attacker to compromise the confidentiality, integrity, and availability of the host system by deserializing untrusted or malicious content.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2025-31324
NetWeaver [RANSOMWARE]
SAP NetWeaver Unrestricted File Upload Vulnerability
due 2025-05-20 · CWE-434
$ cat CVE-2025-31324.txt
Description. SAP NetWeaver Visual Composer Metadata Uploader contains an unrestricted file upload vulnerability that allows an unauthenticated agent to upload potentially malicious executable binaries.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2017-12637
NetWeaver
SAP NetWeaver Directory Traversal Vulnerability
due 2025-04-09 · CWE-22
$ cat CVE-2017-12637.txt
Description. SAP NetWeaver Application Server (AS) Java contains a directory traversal vulnerability in scheduler/ui/js/ffffffffbca41eb4/UIUtilJavaScriptJS that allows a remote attacker to read arbitrary files via a .. (dot dot) in the query string.
Required action. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- CVE-2019-0344
Commerce Cloud
SAP Commerce Cloud Deserialization of Untrusted Data Vulnerability
due 2024-10-21 · CWE-502
$ cat CVE-2019-0344.txt
Description. SAP Commerce Cloud (formerly known as Hybris) contains a deserialization of untrusted data vulnerability within the mediaconversion and virtualjdbc extension that allows for code injection.
Required action. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- CVE-2022-22536
Multiple Products
SAP Multiple Products HTTP Request Smuggling Vulnerability
due 2022-09-08 · CWE-444
$ cat CVE-2022-22536.txt
Description. SAP NetWeaver Application Server ABAP, SAP NetWeaver Application Server Java, ABAP Platform, SAP Content Server and SAP Web Dispatcher allow HTTP request smuggling. An unauthenticated attacker can prepend a victim's request with arbitrary data, allowing for function execution impersonating the victim or poisoning intermediary Web caches.
Required action. Apply updates per vendor instructions.
- CVE-2016-2386
NetWeaver
SAP NetWeaver SQL Injection Vulnerability
due 2022-06-30 · CWE-89
$ cat CVE-2016-2386.txt
Description. SQL injection vulnerability in the UDDI server in SAP NetWeaver J2EE Engine 7.40 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.
Required action. Apply updates per vendor instructions.
- CVE-2016-2388
NetWeaver
SAP NetWeaver Information Disclosure Vulnerability
due 2022-06-30 · CWE-200
$ cat CVE-2016-2388.txt
Description. The Universal Worklist Configuration in SAP NetWeaver AS JAVA 7.4 allows remote attackers to obtain sensitive user information via a crafted HTTP request.
Required action. Apply updates per vendor instructions.
- CVE-2021-38163
NetWeaver
SAP NetWeaver Unrestricted File Upload Vulnerability
due 2022-06-30 · CWE-23
$ cat CVE-2021-38163.txt
Description. SAP NetWeaver contains a vulnerability that allows unrestricted file upload.
Required action. Apply updates per vendor instructions.
- CVE-2010-5326
NetWeaver
SAP NetWeaver Remote Code Execution Vulnerability
due 2022-05-03
$ cat CVE-2010-5326.txt
Description. SAP NetWeaver Application Server Java Platforms Invoker Servlet does not require authentication, allowing for remote code execution via a HTTP or HTTPS request.
Required action. Apply updates per vendor instructions.
- CVE-2016-3976
NetWeaver
SAP NetWeaver Directory Traversal Vulnerability
due 2022-05-03 · CWE-22
$ cat CVE-2016-3976.txt
Description. SAP NetWeaver Application Server Java Platforms contains a directory traversal vulnerability via a ..\ (dot dot backslash) in the fileName parameter to CrashFileDownloadServlet. This allows remote attackers to read files.
Required action. Apply updates per vendor instructions.
- CVE-2016-9563
NetWeaver
SAP NetWeaver XML External Entity (XXE) Vulnerability
due 2022-05-03 · CWE-611
$ cat CVE-2016-9563.txt
Description. SAP NetWeaver Application Server Java Platforms contains an unspecified vulnerability in BC-BMT-BPM-DSK which allows remote, authenticated users to conduct XML External Entity (XXE) attacks.
Required action. Apply updates per vendor instructions.
- CVE-2018-2380
Customer Relationship Management (CRM) [RANSOMWARE]
SAP Customer Relationship Management (CRM) Path Traversal Vulnerability
due 2022-05-03 · CWE-22
$ cat CVE-2018-2380.txt
Description. SAP Customer Relationship Management (CRM) contains a path traversal vulnerability that allows an attacker to exploit insufficient validation of path information provided by users.
Required action. Apply updates per vendor instructions.
- CVE-2020-6207
Solution Manager
SAP Solution Manager Missing Authentication for Critical Function Vulnerability
due 2022-05-03 · CWE-306
$ cat CVE-2020-6207.txt
Description. SAP Solution Manager User Experience Monitoring contains a missing authentication for critical function vulnerability which results in complete compromise of all SMDAgents connected to the Solution Manager.
Required action. Apply updates per vendor instructions.
- CVE-2020-6287
NetWeaver
SAP NetWeaver Missing Authentication for Critical Function Vulnerability
due 2022-05-03 · CWE-306
$ cat CVE-2020-6287.txt
Description. SAP NetWeaver Application Server Java Platforms contains a missing authentication for critical function vulnerability allowing unauthenticated access to execute configuration tasks and create administrative users.
Required action. Apply updates per vendor instructions.