https://patchfirst.co/vendor/sap/New and newly exploited SAP CVEs, with CISA KEV, EPSS and ATT&CK context. Newest 50 by publication or KEV listing.en-gb360Sat, 31 Oct 2026 05:11:25 GMThttps://patchfirst.co/cve/CVE-2026-89107/CVE-2026-89107Tue, 13 Oct 2026 00:00:00 GMTSAP_SE · SAP S/4HANA (Manage Substitution/Validation Rules). Not in CISA KEV. EPSS 0.5% (higher than 41.5% of CVEs). CVSS 9.9 CRITICAL. Priority 17.4 of 100.https://patchfirst.co/cve/CVE-2026-89110/CVE-2026-89110Tue, 13 Oct 2026 00:00:00 GMTSAP_SE · SAP NetWeaver Visual Composer. Not in CISA KEV. EPSS 0.4% (higher than 34.3% of CVEs). CVSS 9.9 CRITICAL. Priority 16.0 of 100.https://patchfirst.co/cve/CVE-2026-89111/CVE-2026-89111Tue, 13 Oct 2026 00:00:00 GMTSAP_SE · SAP Cloud. Not in CISA KEV. EPSS 0.4% (higher than 31.2% of CVEs). CVSS 10.0 CRITICAL. Priority 15.4 of 100.https://patchfirst.co/cve/CVE-2026-89108/CVE-2026-89108Tue, 13 Oct 2026 00:00:00 GMTSAP_SE · SAP Manufacturing Integration and Intelligence (Configuration Service). Not in CISA KEV. EPSS 0.4% (higher than 32.7% of CVEs). CVSS 9.1 CRITICAL. Priority 15.1 of 100.https://patchfirst.co/cve/CVE-2026-58231/CVE-2026-58231Tue, 11 Aug 2026 00:00:00 GMTSAP_SE · SAP Commerce Cloud (Data Hub Adapter). Not in CISA KEV. EPSS 0.9% (higher than 58.3% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. Priority 71.5 of 100.public-exploithttps://patchfirst.co/cve/CVE-2025-42957/CVE-2025-42957Tue, 12 Aug 2025 00:00:00 GMTSAP_SE · SAP S/4HANA (Private Cloud or On-Premise). Not in CISA KEV. EPSS 1.6% (higher than 76.4% of CVEs). CVSS 9.9 CRITICAL. Public exploit code exists. Priority 63.8 of 100.public-exploithttps://patchfirst.co/cve/CVE-2025-42999/CVE-2025-42999#kevThu, 15 May 2025 00:00:00 GMTSAP · NetWeaver. In CISA KEV since 2025-05-15, known ransomware use. ENISA EUVD lists it as exploited. EPSS 12.9% (higher than 96.3% of CVEs). CVSS 9.1 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter; T1505.003 Web Shell. Priority 78.6 of 100.kevransomwarepublic-exploitT1190T1059T1505.003https://patchfirst.co/cve/CVE-2025-31324/CVE-2025-31324#kevTue, 29 Apr 2025 00:00:00 GMTSAP · NetWeaver. In CISA KEV since 2025-04-29, known ransomware use. ENISA EUVD lists it as exploited. EPSS 99.5% (higher than 99.94% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1055 Process Injection; T1505.003 Web Shell; T1059 Command and Scripting Interpreter; T1602 Data from Configuration Repository. Named in 1 threat report. Priority 83.7 of 100.kevransomwarepublic-exploitT1055T1505.003T1059T1602https://patchfirst.co/cve/CVE-2017-12637/CVE-2017-12637#kevWed, 19 Mar 2025 00:00:00 GMTSAP · NetWeaver. In CISA KEV since 2025-03-19. ENISA EUVD lists it as exploited. EPSS 95.1% (higher than 99.86% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1083 File and Directory Discovery; T1555 Credentials from Password Stores; T1592 Gather Victim Host Information. Priority 68.2 of 100.kevpublic-exploitT1190T1083T1555T1592https://patchfirst.co/cve/CVE-2019-0344/CVE-2019-0344#kevMon, 30 Sep 2024 00:00:00 GMTSAP · Commerce Cloud. In CISA KEV since 2024-09-30. ENISA EUVD lists it as exploited. EPSS 7.5% (higher than 94.5% of CVEs). CVSS 9.8 CRITICAL. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 63.8 of 100.kevT1190T1059https://patchfirst.co/cve/CVE-2024-41730/CVE-2024-41730Tue, 13 Aug 2024 00:00:00 GMTSAP_SE · SAP BusinessObjects Business Intelligence Platform. Not in CISA KEV. EPSS 75.9% (higher than 99.53% of CVEs). CVSS 9.8 CRITICAL. Priority 28.1 of 100.https://patchfirst.co/cve/CVE-2022-22536/CVE-2022-22536#kevThu, 18 Aug 2022 00:00:00 GMTSAP · Multiple Products. In CISA KEV since 2022-08-18. ENISA EUVD lists it as exploited. EPSS 97.9% (higher than 99.91% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1557 Adversary-in-the-Middle. Priority 70.0 of 100.kevpublic-exploitT1190T1557https://patchfirst.co/cve/CVE-2016-2386/CVE-2016-2386#kevThu, 09 Jun 2022 00:00:00 GMTSAP · NetWeaver. In CISA KEV since 2022-06-09. ENISA EUVD lists it as exploited. EPSS 71.5% (higher than 99.42% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1059 Command and Scripting Interpreter. Priority 69.7 of 100.kevpublic-exploitT1190T1059https://patchfirst.co/cve/CVE-2021-38163/CVE-2021-38163#kevThu, 09 Jun 2022 00:00:00 GMTSAP · NetWeaver. In CISA KEV since 2022-06-09. ENISA EUVD lists it as exploited. EPSS 36.9% (higher than 98.5% of CVEs). CVSS 8.8 HIGH. Public exploit code exists. ATT&CK: T1078 Valid Accounts; T1059 Command and Scripting Interpreter. Priority 68.9 of 100.kevpublic-exploitT1078T1059https://patchfirst.co/cve/CVE-2016-2388/CVE-2016-2388#kevThu, 09 Jun 2022 00:00:00 GMTSAP · NetWeaver. In CISA KEV since 2022-06-09. ENISA EUVD lists it as exploited. EPSS 52.2% (higher than 99% of CVEs). CVSS 5.3 MEDIUM. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 66.5 of 100.kevpublic-exploitT1190T1005https://patchfirst.co/cve/CVE-2021-42063/CVE-2021-42063Tue, 14 Dec 2021 00:00:00 GMTSAP SE · SAP Knowledge Warehouse. Not in CISA KEV. EPSS 23.4% (higher than 97.8% of CVEs). Public exploit code exists. Priority 59.6 of 100.public-exploithttps://patchfirst.co/cve/CVE-2018-2380/CVE-2018-2380#kevWed, 03 Nov 2021 00:00:00 GMTSAP · Customer Relationship Management (CRM). In CISA KEV since 2021-11-03, known ransomware use. ENISA EUVD lists it as exploited. EPSS 28.9% (higher than 98.2% of CVEs). CVSS 6.6 MEDIUM. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 77.3 of 100.kevransomwarepublic-exploitT1190T1005https://patchfirst.co/cve/CVE-2020-6287/CVE-2020-6287#kevWed, 03 Nov 2021 00:00:00 GMTSAP · NetWeaver. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 94.7% (higher than 99.86% of CVEs). CVSS 10.0 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 70.0 of 100.kevpublic-exploitT1190T1078https://patchfirst.co/cve/CVE-2020-6207/CVE-2020-6207#kevWed, 03 Nov 2021 00:00:00 GMTSAP · Solution Manager. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 98.1% (higher than 99.91% of CVEs). CVSS 9.8 CRITICAL. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1078 Valid Accounts. Priority 69.8 of 100.kevpublic-exploitT1190T1078https://patchfirst.co/cve/CVE-2016-3976/CVE-2016-3976#kevWed, 03 Nov 2021 00:00:00 GMTSAP · NetWeaver. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 47.3% (higher than 98.8% of CVEs). CVSS 7.5 HIGH. Public exploit code exists. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 68.0 of 100.kevpublic-exploitT1190T1005https://patchfirst.co/cve/CVE-2010-5326/CVE-2010-5326#kevWed, 03 Nov 2021 00:00:00 GMTSAP · NetWeaver. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 17.8% (higher than 97.2% of CVEs). CVSS 10.0 CRITICAL. ATT&CK: T1059 Command and Scripting Interpreter; T1190 Exploit Public-Facing Application. Priority 64.4 of 100.kevT1059T1190https://patchfirst.co/cve/CVE-2016-9563/CVE-2016-9563#kevWed, 03 Nov 2021 00:00:00 GMTSAP · NetWeaver. In CISA KEV since 2021-11-03. ENISA EUVD lists it as exploited. EPSS 24.2% (higher than 97.9% of CVEs). CVSS 6.5 MEDIUM. ATT&CK: T1190 Exploit Public-Facing Application; T1005 Data from Local System. Priority 62.1 of 100.kevT1190T1005https://patchfirst.co/cve/CVE-2021-33690/CVE-2021-33690Wed, 15 Sep 2021 00:00:00 GMTSAP SE · SAP NetWeaver Development Infrastructure (Component Build Service). Not in CISA KEV. EPSS 69.1% (higher than 99.35% of CVEs). CVSS 9.9 CRITICAL. Public exploit code exists. Priority 67.5 of 100.public-exploithttps://patchfirst.co/cve/CVE-2021-21479/CVE-2021-21479Tue, 09 Feb 2021 00:00:00 GMTSAP SE · SCIMono. Not in CISA KEV. EPSS 10.1% (higher than 95.6% of CVEs). CVSS 8.1 HIGH. Public exploit code exists. Priority 64.8 of 100.public-exploithttps://patchfirst.co/cve/CVE-2020-26836/CVE-2020-26836Wed, 09 Dec 2020 00:00:00 GMTSAP SE · SAP Solution Manager (Trace Analysis). Not in CISA KEV. EPSS 2.2% (higher than 82.5% of CVEs). CVSS 3.4 LOW. Public exploit code exists. Priority 63.9 of 100.public-exploithttps://patchfirst.co/cve/CVE-2020-6308/CVE-2020-6308Tue, 20 Oct 2020 00:00:00 GMTSAP SE · SAP BusinessObjects Business Intelligence Platform (Web Services). Not in CISA KEV. EPSS 61.7% (higher than 99.17% of CVEs). CVSS 5.3 MEDIUM. Public exploit code exists. Priority 63.5 of 100.public-exploithttps://patchfirst.co/cve/CVE-2020-6286/CVE-2020-6286Tue, 14 Jul 2020 00:00:00 GMTSAP SE · SAP NetWeaver AS JAVA (LM Configuration Wizard). Not in CISA KEV. EPSS 23.7% (higher than 97.8% of CVEs). CVSS 5.3 MEDIUM. Public exploit code exists. Priority 69.0 of 100.public-exploithttps://patchfirst.co/cve/CVE-2018-2392/CVE-2018-2392Wed, 14 Feb 2018 00:00:00 GMTSAP SE · SAP Internet Graphics Server. Not in CISA KEV. EPSS 41.1% (higher than 98.7% of CVEs). Public exploit code exists. Priority 59.7 of 100.public-exploit